2023 CVEs (page 130)
Page 130 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37283 | High | 8.1 | 2023-10-25 | Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter |
CVE-2023-36085 | Medium | 6.1 | 2023-10-25 | The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" endpoint. By modifying… |
CVE-2023-34447 | High | 8.8 | 2023-10-25 | iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, on `pages/UI.php`, cross site scripting is possible. This… |
CVE-2023-34446 | High | 8.8 | 2023-10-25 | iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, when displaying `pages/preferences.php`, cross site script… |
CVE-2023-34085 | Low | 2.6 | 2023-10-25 | When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request |
CVE-2023-34056 | Medium | 4.3 | 2023-10-25 | vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage thi… |
CVE-2023-34048 | Critical | 9.8 | 2023-10-25 | vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Ser… |
CVE-2023-31582 | High | 7.5 | 2023-10-25 | jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less. |
CVE-2023-31581 | Critical | 9.8 | 2023-10-25 | Dromara Sureness before v1.0.8 was discovered to use a hardcoded key. |
CVE-2023-31580 | Medium | 5.9 | 2023-10-25 | light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafte… |
CVE-2023-30912 | High | 7.2 | 2023-10-25 | A remote code execution issue exists in HPE OneView. |
CVE-2023-29973 | Medium | 4.9 | 2023-10-25 | Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall. |
CVE-2023-27377 | High | 7.5 | 2023-10-25 | Missing authentication in the StudentPopupDetails_EmergencyContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction o… |
CVE-2023-27376 | High | 7.5 | 2023-10-25 | Missing authentication in the StudentPopupDetails_StudentDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitiv… |
CVE-2023-27375 | High | 7.5 | 2023-10-25 | Missing authentication in the StudentPopupDetails_ContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitiv… |
CVE-2023-27262 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of a… |
CVE-2023-27261 | Medium | 5.3 | 2023-10-25 | Missing authentication in the DeleteAssignments method in IDAttend’s IDWeb application 3.1.052 and earlier allows deletion of data by unauthenticated a… |
CVE-2023-27260 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of a… |
CVE-2023-27259 | High | 7.5 | 2023-10-25 | Missing authentication in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student and teac… |
CVE-2023-27258 | High | 7.5 | 2023-10-25 | Missing authentication in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of student and teacher da… |
CVE-2023-27257 | High | 7.5 | 2023-10-25 | Missing authentication in the GetActiveToiletPasses method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of student information by un… |
CVE-2023-27256 | Medium | 5.8 | 2023-10-25 | Missing authentication in the GetLogFiles method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of sensitive log files by unauthenticat… |
CVE-2023-27255 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the DeleteRoomChanges method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of al… |
CVE-2023-27254 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetRoomChanges method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all da… |
CVE-2023-26584 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetStudentInconsistencies method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification… |
CVE-2023-26583 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetCurrentPeriod method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all da… |
CVE-2023-26582 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetExcursionDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all… |
CVE-2023-26581 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetVisitors method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by u… |
CVE-2023-26580 | High | 7.5 | 2023-10-25 | Unauthenticated arbitrary file read in the IDAttend’s IDWeb application 3.1.013 allows the retrieval of any file present on the web server by unauthenticated a… |
CVE-2023-26579 | Medium | 5.3 | 2023-10-25 | Missing authentication in the DeleteStaff method in IDAttend’s IDWeb application 3.1.013 allows deletion of staff information by unauthenticated attackers. |
CVE-2023-26578 | High | 8.8 | 2023-10-25 | Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP… |
CVE-2023-26577 | High | 7.5 | 2023-10-25 | Stored cross-site scripting in the IDAttend’s IDWeb application 3.1.052 and earlier allows attackers to hijack the browsing session of the logged in user. |
CVE-2023-26576 | High | 7.5 | 2023-10-25 | Missing authentication in the SearchStudentsRFID method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unaut… |
CVE-2023-26575 | High | 7.5 | 2023-10-25 | Missing authentication in the SearchStudentsStaff method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student and teacher d… |
CVE-2023-26574 | High | 7.5 | 2023-10-25 | Missing authentication in the SearchStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthentic… |
CVE-2023-26573 | High | 8.2 | 2023-10-25 | Missing authentication in the SetDB method in IDAttend’s IDWeb application 3.1.052 and earlier allows denial of service or theft of database login credentials. |
CVE-2023-26572 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetExcursionList method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data… |
CVE-2023-26571 | High | 7.5 | 2023-10-25 | Missing authentication in the SetStudentNotes method in IDAttend’s IDWeb application 3.1.052 and earlier allows modification of student data by unauthenticate… |
CVE-2023-26570 | High | 7.5 | 2023-10-25 | Missing authentication in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data… |
CVE-2023-26569 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification… |
CVE-2023-26568 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of al… |
CVE-2023-26219 | High | 7.4 | 2023-10-25 | The Hawk Console and Hawk Agent components of TIBCO Software Inc.'s TIBCO Hawk, TIBCO Hawk Distribution for TIBCO Silver Fabric, TIBCO Operational Intelligence… |
CVE-2023-25032 | Medium | 5.9 | 2023-10-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Print, PDF, Email by PrintFriendly plugin <= 5.5.1 versions. |
CVE-2023-20273 | High | 7.2 | 2023-10-25 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. Th… |
CVE-2023-1356 | High | 7.5 | 2023-10-25 | Reflected cross-site scripting in the StudentSearch component in IDAttend’s IDWeb application 3.1.052 and earlier allows hijacking of a user’s browsing session… |
CVE-2023-46059 | Medium | 4.8 | 2023-10-24 | Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the Servic… |
CVE-2023-46058 | Medium | 4.8 | 2023-10-24 | Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the grp_de… |
CVE-2023-33517 | High | 7.5 | 2023-10-23 | carRental 1.0 is vulnerable to Incorrect Access Control (Arbitrary File Read on the Back-end System). |
CVE-2023-5633 | High | 7.8 | 2023-10-23 | The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled wh… |
CVE-2023-45998 | Medium | 5.4 | 2023-10-23 | kodbox 1.44 is vulnerable to Cross Site Scripting (XSS). Customizing global HTML results in storing XSS. |
CVE-2023-44760 | Medium | 4.8 | 2023-10-23 | Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and… |
CVE-2023-43358 | Medium | 5.4 | 2023-10-23 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in t… |
CVE-2023-45966 | High | 7.5 | 2023-10-23 | umputun remark42 version 1.12.1 and before has a Blind Server-Side Request Forgery (SSRF) vulnerability. |
CVE-2023-37636 | Medium | 5.4 | 2023-10-23 | A stored cross-site scripting (XSS) vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted p… |
CVE-2023-37635 | Critical | 9.8 | 2023-10-23 | UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application. |
CVE-2023-27152 | Critical | 9.8 | 2023-10-23 | DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentication. |
CVE-2023-46603 | High | 8.8 | 2023-10-23 | In International Color Consortium DemoIccMAX 79ecb74, there is an out-of-bounds read in the CIccPRMG::GetChroma function in IccProfLib/IccPrmg.cpp in libSample… |
CVE-2023-46602 | High | 8.8 | 2023-10-23 | In International Color Consortium DemoIccMAX 79ecb74, there is a stack-based buffer overflow in the icFixXml function in IccXML/IccLibXML/IccUtilXml.cpp in lib… |
CVE-2023-33840 | Medium | 4.8 | 2023-10-23 | IBM Security Verify Governance 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu… |
CVE-2023-33839 | High | 7.2 | 2023-10-23 | IBM Security Verify Governance 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted requ… |
CVE-2023-33837 | Medium | 4.1 | 2023-10-23 | IBM Security Verify Governance 10.0 does not encrypt sensitive or critical information before storage or transmission. IBM X-Force ID: 256020. |
CVE-2023-27149 | Medium | 4.8 | 2023-10-23 | A stored cross-site scripting (XSS) vulnerability in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo… |
CVE-2023-27148 | Medium | 4.8 | 2023-10-23 | A stored cross-site scripting (XSS) vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML… |
CVE-2023-46288 | Medium | 4.3 | 2023-10-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0. Sensitive co… |
CVE-2023-43045 | Medium | 5.9 | 2023-10-23 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM… |
CVE-2023-38722 | Medium | 6.4 | 2023-10-23 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrar… |
CVE-2023-46331 | Medium | 5.5 | 2023-10-23 | WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange(), which lead to segmentation fault. |
CVE-2023-37532 | Medium | 5.8 | 2023-10-23 | HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system. |
CVE-2023-46332 | Medium | 5.5 | 2023-10-23 | WebAssembly wabt 1.0.33 contains an Out-of-Bound Memory Write in DataSegment::Drop(), which lead to segmentation fault. |
CVE-2023-46122 | Low | 3.9 | 2023-10-23 | sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potent… |
CVE-2023-43067 | Medium | 4.9 | 2023-10-23 | Dell Unity prior to 5.3 contains an XML External Entity injection vulnerability. An XXE attack could potentially exploit this vulnerability disclosing local f… |
CVE-2023-43066 | Medium | 5.1 | 2023-10-23 | Dell Unity prior to 5.3 contains a Restricted Shell Bypass vulnerability. This could allow an authenticated, local attacker to exploit this vulnerability by a… |
CVE-2023-5718 | Medium | 4.3 | 2023-10-23 | The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API. By creating a malicious web… |
CVE-2023-46127 | Medium | 5.4 | 2023-10-23 | Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user… |
CVE-2023-43074 | Medium | 5.2 | 2023-10-23 | Dell Unity 5.3 contain(s) an Arbitrary File Creation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by crafting… |
CVE-2023-43065 | Medium | 5.5 | 2023-10-23 | Dell Unity prior to 5.3 contains a Cross-site scripting vulnerability. A low-privileged authenticated attacker can exploit these issues to obtain escalated pr… |
CVE-2023-42295 | High | 8.8 | 2023-10-23 | An issue in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service via the read_rle_image function of fil… |
CVE-2023-28805 | Medium | 6.7 | 2023-10-23 | An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation. This issue affects Client Connector: before 1.4.0… |
CVE-2023-28804 | High | 8.2 | 2023-10-23 | An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Clien… |
CVE-2023-28803 | Medium | 5.9 | 2023-10-23 | An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypas… |
CVE-2023-28797 | Medium | 6.3 | 2023-10-23 | Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk. A malicious user can replace the folde… |
CVE-2023-28796 | High | 7.1 | 2023-10-23 | Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Co… |
CVE-2023-28795 | High | 7.8 | 2023-10-23 | Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects Zscaler Client Conn… |
CVE-2023-28793 | High | 7.8 | 2023-10-23 | Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connect… |
CVE-2023-5246 | High | 8.8 | 2023-10-23 | Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1051432, 1127487, 10… |
CVE-2023-45802 | Medium | 5.9 | 2023-10-23 | When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de… |
CVE-2023-43622 | High | 7.5 | 2023-10-23 | An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. Th… |
CVE-2023-31122 | High | 7.5 | 2023-10-23 | Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. |
CVE-2023-43624 | Medium | 5.5 | 2023-10-23 | CX-Designer Ver.3.740 and earlier (included in CX-One CXONE-AL[][]D-V4) contains an improper restriction of XML external entity reference (XXE) vulnerability… |
CVE-2023-5702 | Medium | 4.3 | 2023-10-23 | A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the fi… |
CVE-2023-5701 | Medium | 4.3 | 2023-10-23 | A vulnerability has been found in vnotex vnote up to 3.17.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2023-46324 | High | 7.5 | 2023-10-23 | pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompr… |
CVE-2023-5700 | Medium | 5.5 | 2023-10-23 | A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file… |
CVE-2023-5699 | Low | 3.5 | 2023-10-23 | A vulnerability, which was classified as problematic, has been found in CodeAstro Internet Banking System 1.0. This issue affects some unknown processing of th… |
CVE-2023-5698 | Low | 3.5 | 2023-10-23 | A vulnerability classified as problematic was found in CodeAstro Internet Banking System 1.0. This vulnerability affects unknown code of the file pages_deposit… |
CVE-2023-5697 | Low | 3.5 | 2023-10-23 | A vulnerability classified as problematic has been found in CodeAstro Internet Banking System 1.0. This affects an unknown part of the file pages_withdraw_mone… |
CVE-2023-46322 | Critical | 9.8 | 2023-10-23 | iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's initial character may be non-alphanumeric. The host… |
CVE-2023-46321 | Critical | 9.8 | 2023-10-23 | iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell metacharacters for a /usr/bin/man command l… |
CVE-2023-46319 | High | 7.5 | 2023-10-23 | WALLIX Bastion 9.x before 9.0.9 and 10.x before 10.0.5 allows unauthenticated access to sensitive information by bypassing access control on a network access a… |
CVE-2023-5696 | Low | 3.5 | 2023-10-22 | A vulnerability was found in CodeAstro Internet Banking System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of t… |