2023 CVEs (page 127)
Page 127 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-46663 | High | 7.5 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to an attacker bypassing authorization and accessing resources behind protected pages. The application interface allo… |
CVE-2023-39726 | Critical | 9.8 | 2023-10-26 | An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal. |
CVE-2023-33559 | High | 8.8 | 2023-10-26 | A local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1 allows attackers to execute arbitrary code by supplying a crafted PHP file. |
CVE-2023-33558 | High | 7.5 | 2023-10-26 | An information disclosure vulnerability in the component users-grid-data.php of Ocomon before v4.0.1 allows attackers to obtain sensitive information such as e… |
CVE-2023-5804 | High | 7.3 | 2023-10-26 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0 and classified as critical. This issue affects some unknown processing of the… |
CVE-2023-5754 | Critical | 9.1 | 2023-10-26 | Sielco PolyEco1000 uses a weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of th… |
CVE-2023-46662 | High | 7.5 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to an information disclosure vulnerability due to improper access control enforcement. An unauthenticated remote attacker… |
CVE-2023-46661 | Critical | 9.8 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests. |
CVE-2023-44267 | Critical | 9.8 | 2023-10-26 | Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'lnm' parameter of the header.php resource does not valida… |
CVE-2023-39936 | High | 7.8 | 2023-10-26 | In Ashlar-Vellum Graphite v13.0.48, the affected application lacks proper validation of user-supplied data when parsing VC6 files. This could lead to an out… |
CVE-2023-39427 | High | 7.8 | 2023-10-26 | In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack proper validation of user-supplied da… |
CVE-2023-0897 | High | 8.8 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session be… |
CVE-2023-31416 | Medium | 5.3 | 2023-10-26 | Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests to an APM Server being accepted an… |
CVE-2023-5796 | Medium | 6.3 | 2023-10-26 | A vulnerability was found in CodeAstro POS System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /setting… |
CVE-2023-5795 | Medium | 6.3 | 2023-10-26 | A vulnerability was found in CodeAstro POS System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-5794 | High | 7.3 | 2023-10-26 | A vulnerability was found in PHPGurukul Online Railway Catering System 1.0. It has been classified as critical. Affected is an unknown function of the file ind… |
CVE-2023-5793 | Low | 3.5 | 2023-10-26 | A vulnerability was found in flusity CMS and classified as problematic. This issue affects the function loadCustomBlocCreateForm of the file /core/tools/custom… |
CVE-2023-46435 | Critical | 9.8 | 2023-10-26 | Sourcecodester Packers and Movers Management System v1.0 is vulnerable to SQL Injection via mpms/?p=services/view_service&id. |
CVE-2023-31419 | Medium | 6.5 | 2023-10-26 | A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Deni… |
CVE-2023-31418 | High | 7.5 | 2023-10-26 | An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to e… |
CVE-2023-31417 | Medium | 4.1 | 2023-10-26 | Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied whe… |
CVE-2023-5792 | Medium | 6.3 | 2023-10-26 | A vulnerability has been found in SourceCodester Sticky Notes App 1.0 and classified as critical. This vulnerability affects unknown code of the file endpoint/… |
CVE-2023-5791 | Low | 3.5 | 2023-10-26 | A vulnerability, which was classified as problematic, was found in SourceCodester Sticky Notes App 1.0. This affects an unknown part of the file endpoint/add-n… |
CVE-2023-5790 | Medium | 6.3 | 2023-10-26 | A vulnerability classified as critical was found in SourceCodester File Manager App 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-5789 | Low | 2.4 | 2023-10-26 | A vulnerability classified as problematic has been found in Dragon Path 707GR1 up to 20231022. Affected is an unknown function of the component Ping Diagnostic… |
CVE-2023-5624 | High | 7.2 | 2023-10-26 | Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. This could allow an admin user to alter parameters that c… |
CVE-2023-5623 | High | 7.0 | 2023-10-26 | NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary code with SYSTEM privileges where NNM… |
CVE-2023-5622 | High | 7.1 | 2023-10-26 | Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to NT AUTHORITY\SYSTEM on Windows hosts by replacing… |
CVE-2023-46666 | Medium | 5.3 | 2023-10-26 | An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user… |
CVE-2023-45317 | High | 8.8 | 2023-10-26 | The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can… |
CVE-2023-45228 | Medium | 6.5 | 2023-10-26 | The application suffers from improper access control when editing users. A user with read permissions can manipulate users, passwords, and permissions by s… |
CVE-2023-43208 | Critical | 9.8 | 2023-10-26 | NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the inc… |
CVE-2023-42769 | Critical | 9.8 | 2023-10-26 | The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass auth… |
CVE-2023-41966 | Medium | 6.5 | 2023-10-26 | The application suffers from a privilege escalation vulnerability. A user with read permissions can elevate privileges by sending a HTTP POST to set a par… |
CVE-2023-5787 | High | 7.3 | 2023-10-26 | A vulnerability was found in Shaanxi Chanming Education Technology Score Query System 5.0. It has been rated as critical. This issue affects some unknown proce… |
CVE-2023-5786 | Medium | 5.3 | 2023-10-26 | A vulnerability was found in GeoServer GeoWebCache up to 1.15.1. It has been declared as problematic. This vulnerability affects unknown code of the file /geos… |
CVE-2023-5785 | Medium | 5.5 | 2023-10-26 | A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /p… |
CVE-2023-5784 | Medium | 5.5 | 2023-10-26 | A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2023-46450 | Medium | 5.4 | 2023-10-26 | Sourcecodester Free and Open Source inventory management system 1.0 is vulnerable to Cross Site Scripting (XSS) via the Add supplier function. |
CVE-2023-46449 | High | 8.8 | 2023-10-26 | Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control. An arbitrary user can change the password of an… |
CVE-2023-46238 | High | 8.7 | 2023-10-26 | ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various image types including SVG. SVG can inclu… |
CVE-2023-46234 | Medium | 6.5 | 2023-10-26 | browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls… |
CVE-2023-45869 | Critical | 9.0 | 2023-10-26 | ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS… |
CVE-2023-45868 | High | 8.1 | 2023-10-26 | The Learning Module in ILIAS 7.25 (2023-09-12 release) allows an attacker (with basic user privileges) to achieve a high-impact Directory Traversal attack on c… |
CVE-2023-45867 | Medium | 6.5 | 2023-10-26 | ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker with a pri… |
CVE-2023-5783 | Medium | 6.3 | 2023-10-26 | A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-5782 | Medium | 5.5 | 2023-10-26 | A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.10. Affected is an unknown function of the file /manage/delete_query.ph… |
CVE-2023-46090 | High | 7.1 | 2023-10-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado WDSocialWidgets plugin <= 1.0.15 versions. |
CVE-2023-41096 | Medium | 6.8 | 2023-10-26 | Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or ex… |
CVE-2023-41095 | Medium | 6.8 | 2023-10-26 | Missing Encryption of Security Keys vulnerability in Silicon Labs OpenThread SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or ext… |
CVE-2023-5781 | Medium | 6.3 | 2023-10-26 | A vulnerability, which was classified as critical, has been found in Tongda OA 2017 11.10. This issue affects the function DELETE_STR of the file general/syste… |
CVE-2023-5780 | High | 7.3 | 2023-10-26 | A vulnerability classified as critical was found in Tongda OA 2017 11.10. This vulnerability affects unknown code of the file general/system/approve_center/flo… |
CVE-2023-46094 | High | 7.1 | 2023-10-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Conversios Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for… |
CVE-2023-46088 | Medium | 5.9 | 2023-10-26 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology WP Full Stripe Free plugin <= 1.6.1 versions. |
CVE-2023-46081 | High | 7.1 | 2023-10-26 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Lavacode Lava Directory Manager plugin <= 1.1.34 versions. |
CVE-2023-46077 | High | 7.1 | 2023-10-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin <= 2.2.5 versions. |
CVE-2023-46076 | High | 7.1 | 2023-10-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao WooCommerce PDF Invoice Builder, Create invoices, packing slips and more plugin <= 1.2.102… |
CVE-2023-46075 | High | 7.1 | 2023-10-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Contact Form Builder, Contact Widget plugin <= 2.1.6 versions. |
CVE-2023-32116 | Medium | 5.9 | 2023-10-26 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in TotalPress.Org Custom post types, Custom Fields & more plugin <= 4.0.12 versions. |
CVE-2023-5802 | Medium | 4.3 | 2023-10-26 | Cross-Site Request Forgery (CSRF) vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowledgebase plugin <= 1.3.4 versions. |
CVE-2023-46074 | Medium | 5.8 | 2023-10-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Borbis Media FreshMail For WordPress plugin <= 2.3.2 versions. |
CVE-2023-46072 | High | 7.1 | 2023-10-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Simpson Add Shortcodes Actions And Filters plugin <= 2.0.9 versions. |
CVE-2023-30492 | Medium | 6.5 | 2023-10-26 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vark Minimum Purchase for WooCommerce plugin <= 2.0.0.1 versions. |
CVE-2023-5798 | High | 8.8 | 2023-10-26 | The Assistant WordPress plugin before 1.4.4 does not validate a parameter before making a request to it via wp_remote_get(), which could allow users with a rol… |
CVE-2023-5139 | Medium | 4.4 | 2023-10-26 | Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver |
CVE-2023-46754 | Medium | 5.3 | 2023-10-26 | The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values. |
CVE-2023-46753 | Medium | 5.9 | 2023-10-26 | An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an… |
CVE-2023-46752 | Medium | 5.9 | 2023-10-26 | An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash. |
CVE-2023-31421 | Medium | 5.9 | 2023-10-26 | It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid fo… |
CVE-2023-31422 | Critical | 9.0 | 2023-10-26 | An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.1… |
CVE-2023-46667 | High | 8.1 | 2023-10-26 | An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text… |
CVE-2023-46668 | Medium | 4.6 | 2023-10-26 | If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elastic Agent… |
CVE-2023-46345 | High | 7.5 | 2023-10-26 | Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/xlsparse.c. |
CVE-2023-43906 | Medium | 6.1 | 2023-10-26 | Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting (XSS) vulnerability. |
CVE-2023-43905 | High | 7.5 | 2023-10-26 | Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors. |
CVE-2023-30969 | High | 8.2 | 2023-10-26 | The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpo… |
CVE-2023-30967 | Critical | 9.8 | 2023-10-26 | Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files… |
CVE-2023-46584 | Critical | 9.8 | 2023-10-25 | SQL Injection vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows a remote attacker to escalate privileges via a crafted req… |
CVE-2023-46583 | Medium | 6.1 | 2023-10-25 | Cross-Site Scripting (XSS) vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows attackers to execute arbitrary code via a cra… |
CVE-2023-46232 | Medium | 5.3 | 2023-10-25 | era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to era-compiler-vype v… |
CVE-2023-38849 | High | 7.5 | 2023-10-25 | An issue in tire-sales Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38848 | High | 7.5 | 2023-10-25 | An issue in rmc R Beauty CLINIC Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38847 | High | 7.5 | 2023-10-25 | An issue in CHRISTINA JAPAN Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38846 | High | 7.5 | 2023-10-25 | An issue in Marbre Lapin Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38845 | High | 7.5 | 2023-10-25 | An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-46233 | Critical | 9.1 | 2023-10-25 | crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at… |
CVE-2023-46137 | Medium | 5.3 | 2023-10-25 | Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web… |
CVE-2023-46134 | Medium | 6.1 | 2023-10-25 | D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to version 3.7.0, users hosting D-Tale publ… |
CVE-2023-46133 | Critical | 9.1 | 2023-10-25 | CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally… |
CVE-2023-45137 | Critical | 9.0 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. `org.xwiki.platform:xwiki-platform-web` starting in ve… |
CVE-2023-5574 | High | 7.0 | 2023-10-25 | A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with mul… |
CVE-2023-5380 | Medium | 4.7 | 2023-10-25 | A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with mult… |
CVE-2023-5367 | High | 7.8 | 2023-10-25 | A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in t… |
CVE-2023-5044 | High | 7.6 | 2023-10-25 | Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation. |
CVE-2023-5043 | High | 7.6 | 2023-10-25 | Ingress nginx annotation injection causes arbitrary command execution. |
CVE-2023-46424 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_422BD4 function. |
CVE-2023-46423 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_417094 function. |
CVE-2023-46422 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411994 function. |
CVE-2023-46421 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411D00 function. |
CVE-2023-46420 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41590C function. |