2023 CVEs (page 130)
Page 130 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-45634 | Medium | 5.8 | 2023-10-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Biztechc Copy or Move Comments plugin <= 5.0.4 versions. |
CVE-2023-45555 | High | 7.8 | 2023-10-25 | File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via a crafted file to the down_url function in zzz.php file. |
CVE-2023-45554 | Critical | 9.8 | 2023-10-25 | File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via modification of the imageext parameter from jpg, jpeg,gif, a… |
CVE-2023-45321 | High | 8.3 | 2023-10-25 | The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocol to retrieve sensit… |
CVE-2023-45220 | High | 8.8 | 2023-10-25 | The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol to retrieve sensiti… |
CVE-2023-44794 | Critical | 9.8 | 2023-10-25 | An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL. |
CVE-2023-44769 | Medium | 5.4 | 2023-10-25 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare alias… |
CVE-2023-44767 | Medium | 4.8 | 2023-10-25 | A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content. |
CVE-2023-43961 | High | 8.8 | 2023-10-25 | An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass. |
CVE-2023-43795 | High | 8.6 | 2023-10-25 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing Service (WPS) specifica… |
CVE-2023-43510 | Medium | 4.7 | 2023-10-25 | A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying ho… |
CVE-2023-43509 | Medium | 5.8 | 2023-10-25 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to compu… |
CVE-2023-43508 | Medium | 6.3 | 2023-10-25 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager allow an attacker with read-only privileges to perform actions that change th… |
CVE-2023-43507 | High | 7.2 | 2023-10-25 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks… |
CVE-2023-43506 | High | 7.8 | 2023-10-25 | A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges to those of a higher role… |
CVE-2023-43488 | High | 7.9 | 2023-10-25 | The vulnerability allows a low privileged (untrusted) application to modify a critical system property that should be denied, in order to enable the ADB (Andr… |
CVE-2023-43360 | Medium | 5.4 | 2023-10-25 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Top Directory parame… |
CVE-2023-43281 | Medium | 6.5 | 2023-10-25 | Double Free vulnerability in Nothings Stb Image.h v.2.28 allows a remote attacker to cause a denial of service via a crafted file to the stbi_load_gif_main fun… |
CVE-2023-42494 | High | 7.5 | 2023-10-25 | EisBaer Scada - CWE-749: Exposed Dangerous Method or Function |
CVE-2023-42493 | High | 7.1 | 2023-10-25 | EisBaer Scada - CWE-256: Plaintext Storage of a Password |
CVE-2023-42492 | High | 7.1 | 2023-10-25 | EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key |
CVE-2023-42491 | High | 8.8 | 2023-10-25 | EisBaer Scada - CWE-285: Improper Authorization |
CVE-2023-42490 | High | 7.5 | 2023-10-25 | EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2023-42489 | High | 7.5 | 2023-10-25 | EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical Resource |
CVE-2023-42488 | High | 7.5 | 2023-10-25 | EisBaer Scada - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2023-42031 | Medium | 4.9 | 2023-10-25 | IBM TXSeries for Multiplatforms, 8.1, 8.2, and 9.1, CICS TX Standard CICS TX Advanced 10.1 and 11.1 could allow a privileged user to cause a denial of service… |
CVE-2023-41960 | High | 7.1 | 2023-10-25 | The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely exposed by the Android Agent applicati… |
CVE-2023-41721 | Medium | 5.3 | 2023-10-25 | Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with… |
CVE-2023-41372 | High | 7.8 | 2023-10-25 | The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client application, induci… |
CVE-2023-41339 | High | 8.6 | 2023-10-25 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defines an ``sld=<url>``… |
CVE-2023-41255 | High | 8.8 | 2023-10-25 | The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of au… |
CVE-2023-3112 | High | 7.8 | 2023-10-25 | A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with el… |
CVE-2023-3010 | High | 7.3 | 2023-10-25 | Grafana is an open-source platform for monitoring and observability. The WorldMap panel plugin, versions before 1.0.4 contains a DOM XSS vulnerability. |
CVE-2023-39930 | High | 7.5 | 2023-10-25 | A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is sent via a malicio… |
CVE-2023-39924 | Medium | 5.9 | 2023-10-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mitchell Bennis Simple File List plugin <= 6.1.9 versions. |
CVE-2023-39740 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39739 | High | 8.2 | 2023-10-25 | The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39737 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39736 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39735 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Uomasa_Saiji_news Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39734 | High | 8.2 | 2023-10-25 | The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the channel access token and send crafted broa… |
CVE-2023-39733 | High | 8.2 | 2023-10-25 | The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39732 | High | 8.2 | 2023-10-25 | The leakage of the client secret in Tokueimaru_waiting Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-39619 | High | 7.5 | 2023-10-25 | ReDos in NPMJS Node Email Check v.1.0.4 allows an attacker to cause a denial of service via a crafted string to the scpSyntax component. |
CVE-2023-39231 | High | 7.3 | 2023-10-25 | PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered devi… |
CVE-2023-39219 | High | 7.5 | 2023-10-25 | PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests |
CVE-2023-38041 | High | 7.0 | 2023-10-25 | A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flow is initiated, an… |
CVE-2023-37913 | Critical | 9.9 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 3.5-milestone-1 and prior to versi… |
CVE-2023-37912 | Critical | 9.9 | 2023-10-25 | XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior to version 14.10.6 of `org.xwiki.platfor… |
CVE-2023-37911 | Medium | 6.5 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 9.4-rc-1 and prior to versions 14… |
CVE-2023-37910 | High | 8.1 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of attachment move supp… |
CVE-2023-37909 | Critical | 9.9 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14… |
CVE-2023-37908 | Critical | 9.0 | 2023-10-25 | XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML render… |
CVE-2023-37283 | High | 8.1 | 2023-10-25 | Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter |
CVE-2023-36085 | Medium | 6.1 | 2023-10-25 | The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" endpoint. By modifying… |
CVE-2023-34447 | High | 8.8 | 2023-10-25 | iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, on `pages/UI.php`, cross site scripting is possible. This… |
CVE-2023-34446 | High | 8.8 | 2023-10-25 | iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, when displaying `pages/preferences.php`, cross site script… |
CVE-2023-34085 | Low | 2.6 | 2023-10-25 | When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request |
CVE-2023-34056 | Medium | 4.3 | 2023-10-25 | vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage thi… |
CVE-2023-34048 | Critical | 9.8 | 2023-10-25 | vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Ser… |
CVE-2023-31582 | High | 7.5 | 2023-10-25 | jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less. |
CVE-2023-31581 | Critical | 9.8 | 2023-10-25 | Dromara Sureness before v1.0.8 was discovered to use a hardcoded key. |
CVE-2023-31580 | Medium | 5.9 | 2023-10-25 | light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafte… |
CVE-2023-30912 | High | 7.2 | 2023-10-25 | A remote code execution issue exists in HPE OneView. |
CVE-2023-29973 | Medium | 4.9 | 2023-10-25 | Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall. |
CVE-2023-27377 | High | 7.5 | 2023-10-25 | Missing authentication in the StudentPopupDetails_EmergencyContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction o… |
CVE-2023-27376 | High | 7.5 | 2023-10-25 | Missing authentication in the StudentPopupDetails_StudentDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitiv… |
CVE-2023-27375 | High | 7.5 | 2023-10-25 | Missing authentication in the StudentPopupDetails_ContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitiv… |
CVE-2023-27262 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of a… |
CVE-2023-27261 | Medium | 5.3 | 2023-10-25 | Missing authentication in the DeleteAssignments method in IDAttend’s IDWeb application 3.1.052 and earlier allows deletion of data by unauthenticated a… |
CVE-2023-27260 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of a… |
CVE-2023-27259 | High | 7.5 | 2023-10-25 | Missing authentication in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student and teac… |
CVE-2023-27258 | High | 7.5 | 2023-10-25 | Missing authentication in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of student and teacher da… |
CVE-2023-27257 | High | 7.5 | 2023-10-25 | Missing authentication in the GetActiveToiletPasses method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of student information by un… |
CVE-2023-27256 | Medium | 5.8 | 2023-10-25 | Missing authentication in the GetLogFiles method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of sensitive log files by unauthenticat… |
CVE-2023-27255 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the DeleteRoomChanges method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of al… |
CVE-2023-27254 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetRoomChanges method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all da… |
CVE-2023-26584 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetStudentInconsistencies method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification… |
CVE-2023-26583 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetCurrentPeriod method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all da… |
CVE-2023-26582 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetExcursionDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all… |
CVE-2023-26581 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetVisitors method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by u… |
CVE-2023-26580 | High | 7.5 | 2023-10-25 | Unauthenticated arbitrary file read in the IDAttend’s IDWeb application 3.1.013 allows the retrieval of any file present on the web server by unauthenticated a… |
CVE-2023-26579 | Medium | 5.3 | 2023-10-25 | Missing authentication in the DeleteStaff method in IDAttend’s IDWeb application 3.1.013 allows deletion of staff information by unauthenticated attackers. |
CVE-2023-26578 | High | 8.8 | 2023-10-25 | Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP… |
CVE-2023-26577 | High | 7.5 | 2023-10-25 | Stored cross-site scripting in the IDAttend’s IDWeb application 3.1.052 and earlier allows attackers to hijack the browsing session of the logged in user. |
CVE-2023-26576 | High | 7.5 | 2023-10-25 | Missing authentication in the SearchStudentsRFID method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unaut… |
CVE-2023-26575 | High | 7.5 | 2023-10-25 | Missing authentication in the SearchStudentsStaff method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student and teacher d… |
CVE-2023-26574 | High | 7.5 | 2023-10-25 | Missing authentication in the SearchStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthentic… |
CVE-2023-26573 | High | 8.2 | 2023-10-25 | Missing authentication in the SetDB method in IDAttend’s IDWeb application 3.1.052 and earlier allows denial of service or theft of database login credentials. |
CVE-2023-26572 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetExcursionList method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data… |
CVE-2023-26571 | High | 7.5 | 2023-10-25 | Missing authentication in the SetStudentNotes method in IDAttend’s IDWeb application 3.1.052 and earlier allows modification of student data by unauthenticate… |
CVE-2023-26570 | High | 7.5 | 2023-10-25 | Missing authentication in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data… |
CVE-2023-26569 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification… |
CVE-2023-26568 | Critical | 9.8 | 2023-10-25 | Unauthenticated SQL injection in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of al… |
CVE-2023-26219 | High | 7.4 | 2023-10-25 | The Hawk Console and Hawk Agent components of TIBCO Software Inc.'s TIBCO Hawk, TIBCO Hawk Distribution for TIBCO Silver Fabric, TIBCO Operational Intelligence… |
CVE-2023-25032 | Medium | 5.9 | 2023-10-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Print, PDF, Email by PrintFriendly plugin <= 5.5.1 versions. |
CVE-2023-20273 | High | 7.2 | 2023-10-25 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. Th… |
CVE-2023-1356 | High | 7.5 | 2023-10-25 | Reflected cross-site scripting in the StudentSearch component in IDAttend’s IDWeb application 3.1.052 and earlier allows hijacking of a user’s browsing session… |
CVE-2023-46059 | Medium | 4.8 | 2023-10-24 | Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the Servic… |
CVE-2023-46058 | Medium | 4.8 | 2023-10-24 | Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the grp_de… |