2023 CVEs (page 127)
Page 127 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-46088 | Medium | 5.9 | 2023-10-26 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology WP Full Stripe Free plugin <= 1.6.1 versions. |
CVE-2023-46081 | High | 7.1 | 2023-10-26 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Lavacode Lava Directory Manager plugin <= 1.1.34 versions. |
CVE-2023-46077 | High | 7.1 | 2023-10-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin <= 2.2.5 versions. |
CVE-2023-46076 | High | 7.1 | 2023-10-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao WooCommerce PDF Invoice Builder, Create invoices, packing slips and more plugin <= 1.2.102… |
CVE-2023-46075 | High | 7.1 | 2023-10-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Contact Form Builder, Contact Widget plugin <= 2.1.6 versions. |
CVE-2023-32116 | Medium | 5.9 | 2023-10-26 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in TotalPress.Org Custom post types, Custom Fields & more plugin <= 4.0.12 versions. |
CVE-2023-5802 | Medium | 4.3 | 2023-10-26 | Cross-Site Request Forgery (CSRF) vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowledgebase plugin <= 1.3.4 versions. |
CVE-2023-46074 | Medium | 5.8 | 2023-10-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Borbis Media FreshMail For WordPress plugin <= 2.3.2 versions. |
CVE-2023-46072 | High | 7.1 | 2023-10-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Simpson Add Shortcodes Actions And Filters plugin <= 2.0.9 versions. |
CVE-2023-30492 | Medium | 6.5 | 2023-10-26 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vark Minimum Purchase for WooCommerce plugin <= 2.0.0.1 versions. |
CVE-2023-5798 | High | 8.8 | 2023-10-26 | The Assistant WordPress plugin before 1.4.4 does not validate a parameter before making a request to it via wp_remote_get(), which could allow users with a rol… |
CVE-2023-5139 | Medium | 4.4 | 2023-10-26 | Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver |
CVE-2023-46754 | Medium | 5.3 | 2023-10-26 | The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values. |
CVE-2023-46753 | Medium | 5.9 | 2023-10-26 | An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an… |
CVE-2023-46752 | Medium | 5.9 | 2023-10-26 | An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash. |
CVE-2023-31421 | Medium | 5.9 | 2023-10-26 | It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid fo… |
CVE-2023-31422 | Critical | 9.0 | 2023-10-26 | An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.1… |
CVE-2023-46667 | High | 8.1 | 2023-10-26 | An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text… |
CVE-2023-46668 | Medium | 4.6 | 2023-10-26 | If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elastic Agent… |
CVE-2023-46345 | High | 7.5 | 2023-10-26 | Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/xlsparse.c. |
CVE-2023-43906 | Medium | 6.1 | 2023-10-26 | Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting (XSS) vulnerability. |
CVE-2023-43905 | High | 7.5 | 2023-10-26 | Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors. |
CVE-2023-30969 | High | 8.2 | 2023-10-26 | The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpo… |
CVE-2023-30967 | Critical | 9.8 | 2023-10-26 | Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files… |
CVE-2023-46584 | Critical | 9.8 | 2023-10-25 | SQL Injection vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows a remote attacker to escalate privileges via a crafted req… |
CVE-2023-46583 | Medium | 6.1 | 2023-10-25 | Cross-Site Scripting (XSS) vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows attackers to execute arbitrary code via a cra… |
CVE-2023-46232 | Medium | 5.3 | 2023-10-25 | era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to era-compiler-vype v… |
CVE-2023-38849 | High | 7.5 | 2023-10-25 | An issue in tire-sales Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38848 | High | 7.5 | 2023-10-25 | An issue in rmc R Beauty CLINIC Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38847 | High | 7.5 | 2023-10-25 | An issue in CHRISTINA JAPAN Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38846 | High | 7.5 | 2023-10-25 | An issue in Marbre Lapin Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-38845 | High | 7.5 | 2023-10-25 | An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. |
CVE-2023-46233 | Critical | 9.1 | 2023-10-25 | crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at… |
CVE-2023-46137 | Medium | 5.3 | 2023-10-25 | Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web… |
CVE-2023-46134 | Medium | 6.1 | 2023-10-25 | D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to version 3.7.0, users hosting D-Tale publ… |
CVE-2023-46133 | Critical | 9.1 | 2023-10-25 | CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally… |
CVE-2023-45137 | Critical | 9.0 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. `org.xwiki.platform:xwiki-platform-web` starting in ve… |
CVE-2023-5574 | High | 7.0 | 2023-10-25 | A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with mul… |
CVE-2023-5380 | Medium | 4.7 | 2023-10-25 | A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with mult… |
CVE-2023-5367 | High | 7.8 | 2023-10-25 | A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in t… |
CVE-2023-5044 | High | 7.6 | 2023-10-25 | Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation. |
CVE-2023-5043 | High | 7.6 | 2023-10-25 | Ingress nginx annotation injection causes arbitrary command execution. |
CVE-2023-46424 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_422BD4 function. |
CVE-2023-46423 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_417094 function. |
CVE-2023-46422 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411994 function. |
CVE-2023-46421 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411D00 function. |
CVE-2023-46420 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41590C function. |
CVE-2023-46419 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415730 function. |
CVE-2023-46418 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_412688 function. |
CVE-2023-46417 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415498 function. |
CVE-2023-46416 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ The 41A414 function. |
CVE-2023-46415 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41E588 function. |
CVE-2023-46414 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ 41D494 function. |
CVE-2023-46413 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_4155DC function. |
CVE-2023-46412 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_41D998 function. |
CVE-2023-46411 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_415258 function. |
CVE-2023-46410 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 416F60 function. |
CVE-2023-46409 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ 41CC04 function. |
CVE-2023-46408 | Critical | 9.8 | 2023-10-25 | TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 41DD80 function. |
CVE-2023-45136 | Critical | 9.6 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name… |
CVE-2023-45135 | Critical | 9.0 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In `org.xwiki.platform:xwiki-platform-web` versions 7… |
CVE-2023-45134 | Critical | 9.0 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. `org.xwiki.platform:xwiki-platform-web` starting in ve… |
CVE-2023-42861 | Medium | 6.5 | 2023-10-25 | A logic issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1. An attacker with knowledge of a standard user's credentia… |
CVE-2023-42857 | Low | 3.3 | 2023-10-25 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app… |
CVE-2023-42856 | High | 7.8 | 2023-10-25 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. Processing a file… |
CVE-2023-42854 | Medium | 5.5 | 2023-10-25 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be… |
CVE-2023-42852 | High | 8.8 | 2023-10-25 | A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Sonoma 14… |
CVE-2023-42850 | Medium | 5.5 | 2023-10-25 | The issue was addressed with improved permissions logic. This issue is fixed in macOS Sonoma 14.1. An app may be able to access sensitive user data. |
CVE-2023-42849 | Medium | 6.5 | 2023-10-25 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Monterey 12.7.1, watchOS 10.1, iOS 16.7.2 and iPa… |
CVE-2023-42847 | High | 7.5 | 2023-10-25 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An attacker may be able to access passkey… |
CVE-2023-42846 | Medium | 5.3 | 2023-10-25 | This issue was addressed by removing the vulnerable code. This issue is fixed in watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, tvOS 17.1, iOS 17.1 and iPadOS 17… |
CVE-2023-42845 | Medium | 5.3 | 2023-10-25 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. Photos in the Hidden… |
CVE-2023-42844 | High | 7.5 | 2023-10-25 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. A website m… |
CVE-2023-42842 | Medium | 5.5 | 2023-10-25 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1. An app may be able to access sensitive user data. |
CVE-2023-42841 | High | 7.8 | 2023-10-25 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1, iOS 16.7.2 and iPadOS 16.7.2, macOS… |
CVE-2023-42438 | Medium | 4.3 | 2023-10-25 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1. Visiting a malicious website may l… |
CVE-2023-41997 | Medium | 4.6 | 2023-10-25 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7… |
CVE-2023-41989 | Medium | 6.8 | 2023-10-25 | The issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sonoma 14.1. An attacker may be able to execute arbitra… |
CVE-2023-41988 | Medium | 6.8 | 2023-10-25 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 17.1 and iPadOS 17.1. A… |
CVE-2023-41983 | Medium | 6.5 | 2023-10-25 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.1, Safari 17.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS… |
CVE-2023-41982 | Medium | 4.6 | 2023-10-25 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7… |
CVE-2023-41977 | Medium | 4.3 | 2023-10-25 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Sonoma 14.1, iOS 16.7.2 and iPadOS 16.7.2. Visiting a malicious website… |
CVE-2023-41976 | High | 8.8 | 2023-10-25 | A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7… |
CVE-2023-41975 | Medium | 4.3 | 2023-10-25 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. A website may… |
CVE-2023-41254 | Medium | 5.5 | 2023-10-25 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 a… |
CVE-2023-41077 | Medium | 5.5 | 2023-10-25 | An app may be able to access protected user data. This issue is fixed in macOS Sonoma 14, macOS Ventura 13.6.1. The issue was addressed with improved checks. |
CVE-2023-41072 | Medium | 5.5 | 2023-10-25 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app… |
CVE-2023-40449 | Medium | 5.5 | 2023-10-25 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, ma… |
CVE-2023-40447 | High | 8.8 | 2023-10-25 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Sonom… |
CVE-2023-40445 | High | 7.5 | 2023-10-25 | The issue was addressed with improved UI handling. This issue is fixed in iOS 17.1 and iPadOS 17.1. A device may persistently fail to lock. |
CVE-2023-40444 | Medium | 5.5 | 2023-10-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1. An app may be able to access user-sensitive data. |
CVE-2023-40425 | Medium | 4.4 | 2023-10-25 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14, macOS Monterey 12.7.1. An app with… |
CVE-2023-40423 | High | 7.8 | 2023-10-25 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, ma… |
CVE-2023-40421 | Medium | 5.5 | 2023-10-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app m… |
CVE-2023-40416 | Medium | 6.5 | 2023-10-25 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, ma… |
CVE-2023-40413 | Medium | 5.5 | 2023-10-25 | The issue was addressed with improved handling of caches. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Monterey 12.7.1, watchOS 10.1, iOS 16.7.2 and… |
CVE-2023-40408 | Medium | 5.3 | 2023-10-25 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 16.7.2 and iPadO… |
CVE-2023-40405 | Low | 3.3 | 2023-10-25 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1. An app may be able to read sensit… |
CVE-2023-40404 | High | 7.8 | 2023-10-25 | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Sonoma 14.1. An app may be able to execute arbitrary code wi… |
CVE-2023-40401 | High | 7.5 | 2023-10-25 | The issue was addressed with additional permissions checks. This issue is fixed in macOS Ventura 13.6.1. An attacker may be able to access passkeys without aut… |