2023 CVEs (page 129)
Page 129 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-46189 | Medium | 4.3 | 2023-10-25 | Cross-Site Request Forgery (CSRF) vulnerability in Simple Calendar – Google Calendar Plugin <= 3.2.5 versions. |
CVE-2023-46158 | Medium | 4.9 | 2023-10-25 | IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to improper resource expiration handling… |
CVE-2023-46152 | Medium | 4.3 | 2023-10-25 | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7.1 versions. |
CVE-2023-46151 | Medium | 4.3 | 2023-10-25 | Cross-Site Request Forgery (CSRF) vulnerability in AWESOME TOGI Product Category Tree plugin <= 2.5 versions. |
CVE-2023-46150 | Medium | 5.4 | 2023-10-25 | Cross-Site Request Forgery (CSRF) vulnerability in WP Military WP Radio plugin <= 3.1.9 versions. |
CVE-2023-46136 | High | 8.0 | 2023-10-25 | Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a… |
CVE-2023-46135 | Medium | 5.3 | 2023-10-25 | rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.`inner_payload_len`… |
CVE-2023-46128 | Medium | 6.5 | 2023-10-25 | Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, c… |
CVE-2023-46126 | Low | 3.9 | 2023-10-25 | Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping enforce privacy reg… |
CVE-2023-46125 | Medium | 6.5 | 2023-10-25 | Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of pri… |
CVE-2023-46124 | High | 8.2 | 2023-10-25 | Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of priv… |
CVE-2023-46123 | Medium | 5.3 | 2023-10-25 | jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the… |
CVE-2023-46120 | Medium | 4.9 | 2023-10-25 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when recei… |
CVE-2023-46119 | High | 7.5 | 2023-10-25 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without exte… |
CVE-2023-46118 | Medium | 4.9 | 2023-10-25 | RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (D… |
CVE-2023-46102 | High | 8.8 | 2023-10-25 | The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI… |
CVE-2023-46071 | High | 7.1 | 2023-10-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ClickDatos Protección de Datos RGPD plugin <= 3.1.0 versions. |
CVE-2023-46070 | High | 7.1 | 2023-10-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Emmanuel GEORJON EG-Attachments plugin <= 2.1.3 versions. |
CVE-2023-46069 | Medium | 6.5 | 2023-10-25 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Osmansorkar Ajax Archive Calendar plugin <= 2.6.7 versions. |
CVE-2023-46068 | Medium | 5.9 | 2023-10-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XQueue GmbH Maileon for WordPress plugin <= 2.16.0 versions. |
CVE-2023-46010 | Critical | 9.8 | 2023-10-25 | An issue in SeaCMS v.12.9 allows an attacker to execute arbitrary commands via the admin_safe.php component. |
CVE-2023-45990 | High | 8.0 | 2023-10-25 | Insecure Permissions vulnerability in WenwenaiCMS v.1.0 allows a remote attacker to escalate privileges. |
CVE-2023-45851 | High | 8.8 | 2023-10-25 | The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication. This issue all… |
CVE-2023-45844 | Medium | 6.8 | 2023-10-25 | The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverag… |
CVE-2023-45837 | High | 7.1 | 2023-10-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in XYDAC Ultimate Taxonomy Manager plugin <= 2.0 versions. |
CVE-2023-45835 | High | 7.1 | 2023-10-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Libsyn Libsyn Publisher Hub plugin <= 1.4.4 versions. |
CVE-2023-45833 | Medium | 5.9 | 2023-10-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in LeadSquared Suite plugin <= 0.7.4 versions. |
CVE-2023-45832 | Medium | 5.9 | 2023-10-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Gibson WP GoToWebinar plugin <= 14.45 versions. |
CVE-2023-45829 | Medium | 6.5 | 2023-10-25 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in HappyBox Newsletter & Bulk Email Sender – Email Newsletter Plugin for WordPress plugin… |
CVE-2023-45772 | High | 7.1 | 2023-10-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Scribit Proofreading plugin <= 1.0.11 versions. |
CVE-2023-45770 | High | 7.1 | 2023-10-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fastwpspeed Fast WP Speed plugin <= 1.0.0 versions. |
CVE-2023-45769 | High | 7.1 | 2023-10-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Alex Raven WP Report Post plugin <= 2.1.2 versions. |
CVE-2023-45768 | Medium | 5.9 | 2023-10-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Stephanie Leary Next Page plugin <= 1.5.2 versions. |
CVE-2023-45767 | Medium | 5.9 | 2023-10-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wokamoto Simple Tweet plugin <= 1.4.0.2 versions. |
CVE-2023-45764 | Medium | 5.9 | 2023-10-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Scroll post excerpt plugin <= 8.0 versions. |
CVE-2023-45761 | High | 7.1 | 2023-10-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Joovii Sendle Shipping Plugin plugin <= 5.13 versions. |
CVE-2023-45759 | High | 7.1 | 2023-10-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Peter Keung Peter’s Custom Anti-Spam plugin <= 3.2.2 versions. |
CVE-2023-45758 | Medium | 5.9 | 2023-10-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi Amministrazione Trasparente plugin <= 8.0.2 versions. |
CVE-2023-45756 | High | 7.1 | 2023-10-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Spider Teams ApplyOnline – Application Form Builder and Manager plugin <= 2.5.2 versions. |
CVE-2023-45755 | Medium | 5.9 | 2023-10-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BuddyBoss BuddyPress Global Search plugin <= 1.2.1 versions. |
CVE-2023-45754 | Medium | 5.9 | 2023-10-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in I Thirteen Web Solution Easy Testimonial Slider and Form… |
CVE-2023-45750 | High | 7.1 | 2023-10-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in POSIMYTH Nexter Extension plugin <= 2.0.3 versions. |
CVE-2023-45747 | Medium | 5.9 | 2023-10-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Syed Balkhi WP Lightbox 2 plugin <= 3.0.6.5 versions. |
CVE-2023-45646 | Medium | 6.5 | 2023-10-25 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Henryholtgeerts PDF Block plugin <= 1.1.0 versions. |
CVE-2023-45644 | Medium | 5.9 | 2023-10-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anurag Deshmukh CPT Shortcode Generator plugin <= 1.0 versions. |
CVE-2023-45640 | Medium | 6.5 | 2023-10-25 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TechnoWich WP ULike – Most Advanced WordPress Marketing Toolkit plugin <= 4.6.8 version… |
CVE-2023-45637 | High | 7.1 | 2023-10-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime EventPrime – Events Calendar, Bookings and Tickets plugin <= 3.1.5 versions. |
CVE-2023-45634 | Medium | 5.8 | 2023-10-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Biztechc Copy or Move Comments plugin <= 5.0.4 versions. |
CVE-2023-45555 | High | 7.8 | 2023-10-25 | File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via a crafted file to the down_url function in zzz.php file. |
CVE-2023-45554 | Critical | 9.8 | 2023-10-25 | File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via modification of the imageext parameter from jpg, jpeg,gif, a… |
CVE-2023-45321 | High | 8.3 | 2023-10-25 | The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocol to retrieve sensit… |
CVE-2023-45220 | High | 8.8 | 2023-10-25 | The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol to retrieve sensiti… |
CVE-2023-44794 | Critical | 9.8 | 2023-10-25 | An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL. |
CVE-2023-44769 | Medium | 5.4 | 2023-10-25 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare alias… |
CVE-2023-44767 | Medium | 4.8 | 2023-10-25 | A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content. |
CVE-2023-43961 | High | 8.8 | 2023-10-25 | An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass. |
CVE-2023-43795 | High | 8.6 | 2023-10-25 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing Service (WPS) specifica… |
CVE-2023-43510 | Medium | 4.7 | 2023-10-25 | A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying ho… |
CVE-2023-43509 | Medium | 5.8 | 2023-10-25 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to compu… |
CVE-2023-43508 | Medium | 6.3 | 2023-10-25 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager allow an attacker with read-only privileges to perform actions that change th… |
CVE-2023-43507 | High | 7.2 | 2023-10-25 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks… |
CVE-2023-43506 | High | 7.8 | 2023-10-25 | A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges to those of a higher role… |
CVE-2023-43488 | High | 7.9 | 2023-10-25 | The vulnerability allows a low privileged (untrusted) application to modify a critical system property that should be denied, in order to enable the ADB (Andr… |
CVE-2023-43360 | Medium | 5.4 | 2023-10-25 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Top Directory parame… |
CVE-2023-43281 | Medium | 6.5 | 2023-10-25 | Double Free vulnerability in Nothings Stb Image.h v.2.28 allows a remote attacker to cause a denial of service via a crafted file to the stbi_load_gif_main fun… |
CVE-2023-42494 | High | 7.5 | 2023-10-25 | EisBaer Scada - CWE-749: Exposed Dangerous Method or Function |
CVE-2023-42493 | High | 7.1 | 2023-10-25 | EisBaer Scada - CWE-256: Plaintext Storage of a Password |
CVE-2023-42492 | High | 7.1 | 2023-10-25 | EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key |
CVE-2023-42491 | High | 8.8 | 2023-10-25 | EisBaer Scada - CWE-285: Improper Authorization |
CVE-2023-42490 | High | 7.5 | 2023-10-25 | EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2023-42489 | High | 7.5 | 2023-10-25 | EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical Resource |
CVE-2023-42488 | High | 7.5 | 2023-10-25 | EisBaer Scada - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2023-42031 | Medium | 4.9 | 2023-10-25 | IBM TXSeries for Multiplatforms, 8.1, 8.2, and 9.1, CICS TX Standard CICS TX Advanced 10.1 and 11.1 could allow a privileged user to cause a denial of service… |
CVE-2023-41960 | High | 7.1 | 2023-10-25 | The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely exposed by the Android Agent applicati… |
CVE-2023-41721 | Medium | 5.3 | 2023-10-25 | Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with… |
CVE-2023-41372 | High | 7.8 | 2023-10-25 | The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client application, induci… |
CVE-2023-41339 | High | 8.6 | 2023-10-25 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defines an ``sld=<url>``… |
CVE-2023-41255 | High | 8.8 | 2023-10-25 | The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of au… |
CVE-2023-3112 | High | 7.8 | 2023-10-25 | A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with el… |
CVE-2023-3010 | High | 7.3 | 2023-10-25 | Grafana is an open-source platform for monitoring and observability. The WorldMap panel plugin, versions before 1.0.4 contains a DOM XSS vulnerability. |
CVE-2023-39930 | High | 7.5 | 2023-10-25 | A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is sent via a malicio… |
CVE-2023-39924 | Medium | 5.9 | 2023-10-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mitchell Bennis Simple File List plugin <= 6.1.9 versions. |
CVE-2023-39740 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39739 | High | 8.2 | 2023-10-25 | The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39737 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39736 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39735 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Uomasa_Saiji_news Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39734 | High | 8.2 | 2023-10-25 | The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the channel access token and send crafted broa… |
CVE-2023-39733 | High | 8.2 | 2023-10-25 | The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39732 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Tokueimaru_waiting Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39619 | High | 7.5 | 2023-10-25 | ReDos in NPMJS Node Email Check v.1.0.4 allows an attacker to cause a denial of service via a crafted string to the scpSyntax component. |
CVE-2023-39231 | High | 7.3 | 2023-10-25 | PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered devi… |
CVE-2023-39219 | High | 7.5 | 2023-10-25 | PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests |
CVE-2023-38041 | High | 7.0 | 2023-10-25 | A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flow is initiated, an… |
CVE-2023-37913 | Critical | 9.9 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 3.5-milestone-1 and prior to versi… |
CVE-2023-37912 | Critical | 9.9 | 2023-10-25 | XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior to version 14.10.6 of `org.xwiki.platfor… |
CVE-2023-37911 | Medium | 6.5 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 9.4-rc-1 and prior to versions 14… |
CVE-2023-37910 | High | 8.1 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of attachment move supp… |
CVE-2023-37909 | Critical | 9.9 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14… |
CVE-2023-37908 | Critical | 9.0 | 2023-10-25 | XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML render… |