2023 CVEs (page 131)
Page 131 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5695 | Low | 3.5 | 2023-10-22 | A vulnerability was found in CodeAstro Internet Banking System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functiona… |
CVE-2023-5694 | Low | 3.5 | 2023-10-22 | A vulnerability was found in CodeAstro Internet Banking System 1.0. It has been classified as problematic. Affected is an unknown function of the file pages_sy… |
CVE-2023-5693 | Medium | 6.3 | 2023-10-22 | A vulnerability was found in CodeAstro Internet Banking System 1.0 and classified as critical. This issue affects some unknown processing of the file pages_res… |
CVE-2023-46317 | High | 7.5 | 2023-10-22 | Knot Resolver before 5.7.0 performs many TCP reconnections upon receiving certain nonsensical responses from servers. |
CVE-2023-46315 | High | 7.5 | 2023-10-22 | The zanllp sd-webui-infinite-image-browsing (aka Infinite Image Browsing) extension before 977815a for stable-diffusion-webui (aka Stable Diffusion web UI), if… |
CVE-2023-46095 | Medium | 5.4 | 2023-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole Smooth Scroll Links [SSL] plugin <= 1.1.0 versions. |
CVE-2023-46089 | Medium | 4.3 | 2023-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Lee Le @ Userback Userback plugin <= 1.0.13 versions. |
CVE-2023-46085 | Medium | 4.3 | 2023-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.2.4 versions. |
CVE-2023-46306 | High | 8.4 | 2023-10-22 | The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command constructed with unsa… |
CVE-2023-46303 | High | 7.5 | 2023-10-22 | link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root. |
CVE-2023-46301 | Critical | 9.8 | 2023-10-22 | iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload. |
CVE-2023-46300 | Critical | 9.8 | 2023-10-22 | iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integration. |
CVE-2023-46298 | High | 7.5 | 2023-10-22 | Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service t… |
CVE-2023-38735 | Medium | 5.7 | 2023-10-22 | IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attack… |
CVE-2023-38276 | Medium | 5.9 | 2023-10-22 | IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in environment variables which could aid in further attacks against the system… |
CVE-2023-38275 | Medium | 5.9 | 2023-10-22 | IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in container images which could lead to further attacks against the system. IB… |
CVE-2023-46078 | Medium | 5.4 | 2023-10-21 | Cross-Site Request Forgery (CSRF) vulnerability in PluginEver WC Serial Numbers plugin <= 1.6.3 versions. |
CVE-2023-46067 | Medium | 4.3 | 2023-10-21 | Cross-Site Request Forgery (CSRF) vulnerability in Qwerty23 Rocket Font plugin <= 1.2.3 versions. |
CVE-2023-5205 | Medium | 6.4 | 2023-10-21 | The Add Custom Body Class plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_custom_body_class' value in versions up to, and includ… |
CVE-2023-4939 | Medium | 5.3 | 2023-10-21 | The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a weak authentication to… |
CVE-2023-4635 | Medium | 6.1 | 2023-10-21 | The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in versions up to, and including, 2.2.2 due to insuffi… |
CVE-2023-5684 | Medium | 4.7 | 2023-10-21 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231012. It has been declared as critical. Affected by this vulnerability is an unkno… |
CVE-2023-46055 | High | 8.8 | 2023-10-21 | An issue in ThingNario Photon v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the ping function to the… |
CVE-2023-46054 | Medium | 5.4 | 2023-10-21 | Cross Site Scripting (XSS) vulnerability in WBCE CMS v.1.6.1 and before allows a remote attacker to escalate privileges via a crafted script to the website_foo… |
CVE-2023-5683 | Medium | 6.3 | 2023-10-21 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the… |
CVE-2023-5132 | High | 7.5 | 2023-10-21 | The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the parseRemoteRequest funct… |
CVE-2023-46003 | Medium | 5.4 | 2023-10-21 | I-doit pro 25 and below is vulnerable to Cross Site Scripting (XSS) via index.php. |
CVE-2023-38194 | Medium | 6.1 | 2023-10-21 | An issue was discovered in SuperWebMailer 9.00.0.01710. It allows keepalive.php XSS via a GET parameter. |
CVE-2023-38193 | High | 8.8 | 2023-10-21 | An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Remote Code Execution via a crafted sendmail command line. |
CVE-2023-38192 | Medium | 6.1 | 2023-10-21 | An issue was discovered in SuperWebMailer 9.00.0.01710. It allows superadmincreate.php XSS via crafted incorrect passwords. |
CVE-2023-38190 | High | 8.8 | 2023-10-21 | An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Export SQL Injection via the size parameter. |
CVE-2023-45682 | Medium | 5.3 | 2023-10-21 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds read in `DECODE` macro when `var` is… |
CVE-2023-45681 | High | 7.3 | 2023-10-21 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in `sta… |
CVE-2023-45680 | Medium | 5.3 | 2023-10-21 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In t… |
CVE-2023-45679 | High | 7.3 | 2023-10-21 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In t… |
CVE-2023-45678 | Medium | 6.5 | 2023-10-21 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in `start_decoder` because at… |
CVE-2023-45677 | High | 7.3 | 2023-10-21 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0… |
CVE-2023-45676 | High | 7.3 | 2023-10-21 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[i] = get8_packet… |
CVE-2023-45675 | Medium | 6.5 | 2023-10-21 | stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)'\0… |
CVE-2023-45667 | Medium | 5.3 | 2023-10-21 | stb_image is a single file MIT licensed library for processing images. If `stbi__load_gif_main` in `stbi_load_gif_from_memory` fails it returns a null pointer… |
CVE-2023-45666 | High | 7.3 | 2023-10-21 | stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn’t give guarantees about the content of out… |
CVE-2023-45664 | High | 7.3 | 2023-10-21 | stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attempt to double-free t… |
CVE-2023-45663 | Medium | 5.3 | 2023-10-21 | stb_image is a single file MIT licensed library for processing images. The stbi__getn function reads a specified number of bytes from context (typically a file… |
CVE-2023-45662 | Medium | 6.5 | 2023-10-21 | stb_image is a single file MIT licensed library for processing images. When `stbi_set_flip_vertically_on_load` is set to `TRUE` and `req_comp` is set to a numb… |
CVE-2023-45661 | Medium | 6.5 | 2023-10-21 | stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in `stbi__gif_load_next`. Thi… |
CVE-2023-43346 | Medium | 5.4 | 2023-10-20 | Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Backend… |
CVE-2023-43357 | Medium | 5.4 | 2023-10-20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in t… |
CVE-2023-43356 | Medium | 5.4 | 2023-10-20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata par… |
CVE-2023-43355 | Medium | 5.4 | 2023-10-20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and passwor… |
CVE-2023-43354 | Medium | 5.4 | 2023-10-20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter i… |
CVE-2023-43353 | Medium | 5.4 | 2023-10-20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the extra parameter in t… |
CVE-2023-38191 | Medium | 6.1 | 2023-10-20 | An issue was discovered in SuperWebMailer 9.00.0.01710. It allows spamtest_external.php XSS via a crafted filename. |
CVE-2023-32786 | High | 7.5 | 2023-10-20 | In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and p… |
CVE-2023-5682 | Medium | 5.5 | 2023-10-20 | A vulnerability has been found in Tongda OA 2017 and classified as critical. This vulnerability affects unknown code of the file general/hr/training/record/del… |
CVE-2023-5681 | Medium | 4.7 | 2023-10-20 | A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /ad… |
CVE-2023-37824 | Critical | 9.8 | 2023-10-20 | Sitolog sitologapplicationconnect v7.8.a and before was discovered to contain a SQL injection vulnerability via the component /activate_hook.php. |
CVE-2023-46117 | High | 8.8 | 2023-10-20 | reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities… |
CVE-2023-45805 | High | 7.8 | 2023-10-20 | pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious `pdm.lock` file that could allow e.g. an… |
CVE-2023-5690 | High | 8.8 | 2023-10-20 | Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2. |
CVE-2023-5689 | Medium | 5.4 | 2023-10-20 | Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2. |
CVE-2023-5688 | Medium | 5.4 | 2023-10-20 | Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2. |
CVE-2023-5687 | High | 8.8 | 2023-10-20 | Cross-Site Request Forgery (CSRF) in GitHub repository mosparo/mosparo prior to 1.0.3. |
CVE-2023-5686 | High | 8.8 | 2023-10-20 | Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. |
CVE-2023-23373 | High | 8.8 | 2023-10-20 | An OS command injection vulnerability has been reported to affect QUSBCam2. If exploited, the vulnerability could allow users to execute commands via a network… |
CVE-2023-3965 | Medium | 6.1 | 2023-10-20 | The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient i… |
CVE-2023-3962 | Medium | 6.1 | 2023-10-20 | The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.4.3 due to insuffic… |
CVE-2023-3933 | Medium | 6.1 | 2023-10-20 | The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to ins… |
CVE-2023-3487 | High | 7.7 | 2023-10-20 | An integer overflow in Silicon Labs Gecko Bootloader version 4.3.1 and earlier allows unbounded memory access when reading from or writing to storage slots. |
CVE-2023-46287 | Medium | 6.1 | 2023-10-20 | XSS exists in NagVis before 1.9.38 via the select function in share/server/core/functions/html.php. |
CVE-2023-5618 | Medium | 6.4 | 2023-10-20 | The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 1.4.16 due… |
CVE-2023-44483 | Medium | 6.5 | 2023-10-20 | All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a priva… |
CVE-2023-44256 | Medium | 6.5 | 2023-10-20 | A server-side request forgery vulnerability [CWE-918] in Fortinet FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 and FortiManager ve… |
CVE-2023-34045 | Medium | 6.6 | 2023-10-20 | VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during installation for the first time (the user needs to dr… |
CVE-2023-34046 | Medium | 6.7 | 2023-10-20 | VMware Fusion(13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during installation for the first time (the user ne… |
CVE-2023-34044 | High | 7.1 | 2023-10-20 | VMware Workstation( 17.x prior to 17.5) and Fusion(13.x prior to 13.5) contain an out-of-bounds read vulnerability that exists in the functionality for sharin… |
CVE-2023-5615 | Medium | 6.4 | 2023-10-20 | The Skype Legacy Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skype-status' shortcode in all versions up to, and… |
CVE-2023-5602 | Medium | 4.3 | 2023-10-20 | The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2… |
CVE-2023-5534 | Medium | 4.3 | 2023-10-20 | The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is due to missing or in… |
CVE-2023-5533 | Medium | 5.3 | 2023-10-20 | The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versio… |
CVE-2023-5337 | Medium | 6.4 | 2023-10-20 | The Contact form Form For All plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions up to, and including, 1… |
CVE-2023-5292 | Medium | 6.4 | 2023-10-20 | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfe_form' shortcode in versions up to, and inc… |
CVE-2023-5231 | Medium | 6.4 | 2023-10-20 | The Magic Action Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.17.2 due to insuffici… |
CVE-2023-5121 | Medium | 4.4 | 2023-10-20 | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings (the backup path parameter) in ve… |
CVE-2023-5109 | Medium | 6.4 | 2023-10-20 | The WP Mailto Links – Protect Email Addresses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wpml_mailto' shortcode in versions up to… |
CVE-2023-5086 | Medium | 6.4 | 2023-10-20 | The Copy Anything to Clipboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'copy' shortcode in versions up to, and including, 2.6.4 d… |
CVE-2023-5070 | Medium | 6.5 | 2023-10-20 | The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2… |
CVE-2023-4999 | High | 8.8 | 2023-10-20 | The Horizontal scrolling announcement plugin for WordPress is vulnerable to SQL Injection via the plugin's [horizontal-scrolling] shortcode in versions up to… |
CVE-2023-4961 | Medium | 6.4 | 2023-10-20 | The Poptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'poptin-form' shortcode in versions up to, and including, 1.3 due to insuffici… |
CVE-2023-4941 | Medium | 4.3 | 2023-10-20 | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe… |
CVE-2023-4926 | Medium | 5.4 | 2023-10-20 | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validat… |
CVE-2023-4924 | Medium | 5.4 | 2023-10-20 | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to missing capability checks on the woobe_… |
CVE-2023-4923 | Medium | 5.4 | 2023-10-20 | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validat… |
CVE-2023-4796 | Medium | 4.3 | 2023-10-20 | The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcj_wp_option' shortcode in versions up to, and including, 7.1.0 due… |
CVE-2023-4668 | Medium | 5.3 | 2023-10-20 | The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL param… |
CVE-2023-4648 | Medium | 4.4 | 2023-10-20 | The WP Customer Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.6.6 due to ins… |
CVE-2023-4386 | High | 8.1 | 2023-10-20 | The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input… |
CVE-2023-4021 | Medium | 4.4 | 2023-10-20 | The Modern Events Calendar lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Google API key and Calendar ID in versions up to, but not… |
CVE-2023-3998 | Medium | 5.3 | 2023-10-20 | The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate function in versions… |
CVE-2023-3996 | Medium | 4.4 | 2023-10-20 | The ARMember Lite - Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.0.16 du… |
CVE-2023-3869 | Medium | 5.3 | 2023-10-20 | The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the voteOnComment function in vers… |