2023 CVEs (page 128)
Page 128 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-32359 | High | 7.5 | 2023-10-25 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2. A user's password may be read a… |
CVE-2023-5758 | Medium | 6.1 | 2023-10-25 | When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS) attack… |
CVE-2023-5753 | Medium | 6.3 | 2023-10-25 | Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c |
CVE-2023-5752 | Medium | 5.5 | 2023-10-25 | When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inje… |
CVE-2023-5746 | Critical | 9.8 | 2023-10-25 | A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via… |
CVE-2023-5745 | Medium | 5.5 | 2023-10-25 | The Reusable Text Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text-blocks' shortcode in versions up to, and including, 1.5.3… |
CVE-2023-5744 | Medium | 6.4 | 2023-10-25 | The Very Simple Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vsgmap' shortcode in all versions up to, and in… |
CVE-2023-5740 | Medium | 6.4 | 2023-10-25 | The Live Chat with Facebook Messenger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'messenger' shortcode in all versions… |
CVE-2023-5732 | Medium | 6.5 | 2023-10-25 | An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited. This vulnerability affect… |
CVE-2023-5731 | Critical | 9.8 | 2023-10-25 | Memory safety bugs present in Firefox 118. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2023-5730 | Critical | 9.8 | 2023-10-25 | Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2023-5729 | Medium | 4.3 | 2023-10-25 | A malicious web site can enter fullscreen mode while simultaneously triggering a WebAuthn prompt. This could have obscured the fullscreen notification and coul… |
CVE-2023-5728 | High | 7.5 | 2023-10-25 | During garbage collection extra operations were performed on a object that should not be. This could have led to a potentially exploitable crash. This vulnerab… |
CVE-2023-5727 | Medium | 6.5 | 2023-10-25 | The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which can run commands on a user's computer… |
CVE-2023-5726 | Medium | 4.3 | 2023-10-25 | A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks… |
CVE-2023-5725 | Medium | 4.3 | 2023-10-25 | A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data. This vulner… |
CVE-2023-5724 | High | 7.5 | 2023-10-25 | Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. This vulnerability affects Firefox < 119… |
CVE-2023-5723 | Medium | 5.3 | 2023-10-25 | An attacker with temporary script access to a site could have set a cookie containing invalid characters using `document.cookie` that could have led to unknown… |
CVE-2023-5722 | Medium | 5.3 | 2023-10-25 | Using iterative requests an attacker was able to learn the size of an opaque response, as well as the contents of a server-supplied Vary header. This vulnerabi… |
CVE-2023-5721 | Medium | 4.3 | 2023-10-25 | It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay. This… |
CVE-2023-5717 | High | 7.8 | 2023-10-25 | A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege esc… |
CVE-2023-5671 | High | 7.8 | 2023-10-25 | HP Print and Scan Doctor for Windows may potentially be vulnerable to escalation of privilege. HP is releasing software updates to mitigate the potential vulne… |
CVE-2023-5568 | Medium | 5.9 | 2023-10-25 | A heap-based Buffer Overflow flaw was discovered in Samba. It could allow a remote, authenticated attacker to exploit this vulnerability to cause a denial of s… |
CVE-2023-5472 | High | 8.8 | 2023-10-25 | Use after free in Profiles in Google Chrome prior to 118.0.5993.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2023-5363 | High | 7.5 | 2023-10-25 | Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns du… |
CVE-2023-5311 | High | 8.8 | 2023-10-25 | The WP EXtra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the register() function in versions u… |
CVE-2023-5127 | Medium | 6.4 | 2023-10-25 | The WP Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.7.9 due to insufficien… |
CVE-2023-5126 | Medium | 4.9 | 2023-10-25 | The Delete Me plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'plugin_delete_me' shortcode in versions up to, and including, 3.0 due to i… |
CVE-2023-5110 | Medium | 6.4 | 2023-10-25 | The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bsk-pdfm-category-dropdown' shortcode in versions up to, and includi… |
CVE-2023-5085 | Medium | 6.4 | 2023-10-25 | The Advanced Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'advMenu' shortcode in versions up to, and including, 0.4.1 due… |
CVE-2023-4693 | Medium | 5.3 | 2023-10-25 | An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS… |
CVE-2023-4692 | High | 7.5 | 2023-10-25 | An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image… |
CVE-2023-4608 | Medium | 4.1 | 2023-10-25 | An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. This affects ThinkSystem v… |
CVE-2023-4607 | High | 7.5 | 2023-10-25 | An authenticated XCC user can change permissions for any user through a crafted API command. |
CVE-2023-4606 | High | 8.1 | 2023-10-25 | An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This affects ThinkSystem v2 and v3… |
CVE-2023-46660 | Medium | 5.3 | 2023-10-25 | Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equ… |
CVE-2023-46659 | Medium | 5.4 | 2023-10-25 | Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scripting (XSS) vulnerab… |
CVE-2023-46658 | Medium | 5.3 | 2023-10-25 | Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook t… |
CVE-2023-46657 | Medium | 5.3 | 2023-10-25 | Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, po… |
CVE-2023-46656 | Medium | 5.3 | 2023-10-25 | Jenkins Multibranch Scan Webhook Trigger Plugin 1.0.9 and earlier uses a non-constant time comparison function when checking whether the provided and expected… |
CVE-2023-46655 | Medium | 6.5 | 2023-10-25 | Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are published during the 'Clou… |
CVE-2023-46654 | High | 8.1 | 2023-10-25 | Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup process of the 'CloudBe… |
CVE-2023-46653 | Medium | 6.5 | 2023-10-25 | Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting in its exposure. |
CVE-2023-46652 | Medium | 4.3 | 2023-10-25 | A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to enumerate credentials ID… |
CVE-2023-46651 | Medium | 6.5 | 2023-10-25 | Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to ac… |
CVE-2023-46650 | Medium | 5.4 | 2023-10-25 | Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a stored cross-site script… |
CVE-2023-46574 | Critical | 9.8 | 2023-10-25 | An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile func… |
CVE-2023-46564 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDMZ. |
CVE-2023-46563 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpQoS. |
CVE-2023-46562 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDosCfg. |
CVE-2023-46560 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formTcpipSetup. |
CVE-2023-46559 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIPv6Addr. |
CVE-2023-46558 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDelDevice. |
CVE-2023-46557 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAPVLAN. |
CVE-2023-46556 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formFilter. |
CVE-2023-46555 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPortFw. |
CVE-2023-46554 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDel. |
CVE-2023-46553 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formParentControl. |
CVE-2023-46552 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAP. |
CVE-2023-46551 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formReflashClientTbl. |
CVE-2023-46550 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDelDevice. |
CVE-2023-46549 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formSetLg. |
CVE-2023-46548 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlanRedirect. |
CVE-2023-46547 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formSysLog. |
CVE-2023-46546 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formStats. |
CVE-2023-46545 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWsc. |
CVE-2023-46544 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWirelessTbl. |
CVE-2023-46543 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlSiteSurvey. |
CVE-2023-46542 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMeshUploadConfig. |
CVE-2023-46541 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpv6Setup. |
CVE-2023-46540 | Critical | 9.8 | 2023-10-25 | TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formNtp. |
CVE-2023-46539 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function registerRequestHandle. |
CVE-2023-46538 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function chkResetVeriRegister. |
CVE-2023-46537 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function getRegVeriRegister. |
CVE-2023-46536 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function chkRegVeriRegister. |
CVE-2023-46535 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function getResetVeriRegister. |
CVE-2023-46534 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function modifyAccPwdRegister. |
CVE-2023-46527 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin and TL-WDR7660 2.0.30 was discovered to contain a stack overflow via the function bindRequestHandle. |
CVE-2023-46526 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function resetCloudPwdRegister. |
CVE-2023-46525 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function loginRegister. |
CVE-2023-46523 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function upgradeInfoRegister. |
CVE-2023-46522 | Critical | 9.8 | 2023-10-25 | TP-LINK device TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin and TL-WDR7660 2.0.30 were discovered to contain a stack overflow via the function deviceInfoR… |
CVE-2023-46521 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function RegisterRegister. |
CVE-2023-46520 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function uninstallPluginReqHandle. |
CVE-2023-46518 | Critical | 9.8 | 2023-10-25 | Mercury A15 V1.0 20230818_1.0.3 was discovered to contain a command execution vulnerability via the component cloudDeviceTokenSuccCB. |
CVE-2023-46396 | Medium | 5.4 | 2023-10-25 | Audimex 15.0.0 is vulnerable to Cross Site Scripting (XSS) in /audimex/cgi-bin/wal.fcgi via company parameter search filters. |
CVE-2023-46373 | Critical | 9.8 | 2023-10-25 | TP-Link TL-WDR7660 2.0.30 has a stack overflow vulnerability via the function deviceInfoJsonToBincauses. |
CVE-2023-46371 | Critical | 9.8 | 2023-10-25 | TP-Link device TL-WDR7660 2.0.30 and TL-WR886N 2.0.12 has a stack overflow vulnerability via the function upgradeInfoJsonToBin. |
CVE-2023-46370 | Critical | 9.8 | 2023-10-25 | Tenda W18E V16.01.0.8(1576) has a command injection vulnerability via the hostName parameter in the formSetNetCheckTools function. |
CVE-2023-46369 | Critical | 9.8 | 2023-10-25 | Tenda W18E V16.01.0.8(1576) contains a stack overflow vulnerability via the portMirrorMirroredPorts parameter in the formSetNetCheckTools function. |
CVE-2023-46358 | Critical | 9.8 | 2023-10-25 | In the module "Referral and Affiliation Program" (referralbyphone) version 3.5.1 and before from Snegurka for PrestaShop, a guest can perform SQL injection. Me… |
CVE-2023-46347 | Critical | 9.8 | 2023-10-25 | In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform SQL injection. The m… |
CVE-2023-46346 | High | 7.5 | 2023-10-25 | In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 4.1.1 from MyPrestaModules for PrestaShop, a guest can download… |
CVE-2023-46316 | Medium | 5.5 | 2023-10-25 | In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines. |
CVE-2023-46204 | Medium | 4.3 | 2023-10-25 | Cross-Site Request Forgery (CSRF) vulnerability in Muller Digital Inc. Duplicate Theme plugin <= 0.1.6 versions. |
CVE-2023-46202 | Medium | 4.3 | 2023-10-25 | Cross-Site Request Forgery (CSRF) vulnerability in Jeff Sherk Auto Login New User After Registration plugin <= 1.9.6 versions. |
CVE-2023-46198 | Medium | 5.4 | 2023-10-25 | Cross-Site Request Forgery (CSRF) vulnerability in Scientech It Solution Appointment Calendar plugin <= 2.9.6 versions. |
CVE-2023-46193 | Medium | 4.3 | 2023-10-25 | Cross-Site Request Forgery (CSRF) vulnerability in Internet Marketing Ninjas Internal Link Building plugin <= 1.2.3 versions. |
CVE-2023-46191 | Medium | 4.3 | 2023-10-25 | Cross-Site Request Forgery (CSRF) vulnerability in Niels van Renselaar Open Graph Metabox plugin <= 1.4.4 versions. |
CVE-2023-46190 | Medium | 4.3 | 2023-10-25 | Cross-Site Request Forgery (CSRF) vulnerability in Novo-media Novo-Map : your WP posts on custom google maps plugin <= 1.1.2 versions. |