2023 CVEs (page 132)
Page 132 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-43356 | Medium | 5.4 | 2023-10-20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata par… |
CVE-2023-43355 | Medium | 5.4 | 2023-10-20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and passwor… |
CVE-2023-43354 | Medium | 5.4 | 2023-10-20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter i… |
CVE-2023-43353 | Medium | 5.4 | 2023-10-20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the extra parameter in t… |
CVE-2023-38191 | Medium | 6.1 | 2023-10-20 | An issue was discovered in SuperWebMailer 9.00.0.01710. It allows spamtest_external.php XSS via a crafted filename. |
CVE-2023-32786 | High | 7.5 | 2023-10-20 | In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and p… |
CVE-2023-5682 | Medium | 5.5 | 2023-10-20 | A vulnerability has been found in Tongda OA 2017 and classified as critical. This vulnerability affects unknown code of the file general/hr/training/record/del… |
CVE-2023-5681 | Medium | 4.7 | 2023-10-20 | A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /ad… |
CVE-2023-37824 | Critical | 9.8 | 2023-10-20 | Sitolog sitologapplicationconnect v7.8.a and before was discovered to contain a SQL injection vulnerability via the component /activate_hook.php. |
CVE-2023-46117 | High | 8.8 | 2023-10-20 | reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities… |
CVE-2023-45805 | High | 7.8 | 2023-10-20 | pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious `pdm.lock` file that could allow e.g. an… |
CVE-2023-5690 | High | 8.8 | 2023-10-20 | Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2. |
CVE-2023-5689 | Medium | 5.4 | 2023-10-20 | Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2. |
CVE-2023-5688 | Medium | 5.4 | 2023-10-20 | Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2. |
CVE-2023-5687 | High | 8.8 | 2023-10-20 | Cross-Site Request Forgery (CSRF) in GitHub repository mosparo/mosparo prior to 1.0.3. |
CVE-2023-5686 | High | 8.8 | 2023-10-20 | Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. |
CVE-2023-23373 | High | 8.8 | 2023-10-20 | An OS command injection vulnerability has been reported to affect QUSBCam2. If exploited, the vulnerability could allow users to execute commands via a network… |
CVE-2023-3965 | Medium | 6.1 | 2023-10-20 | The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient i… |
CVE-2023-3962 | Medium | 6.1 | 2023-10-20 | The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.4.3 due to insuffic… |
CVE-2023-3933 | Medium | 6.1 | 2023-10-20 | The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to ins… |
CVE-2023-3487 | High | 7.7 | 2023-10-20 | An integer overflow in Silicon Labs Gecko Bootloader version 4.3.1 and earlier allows unbounded memory access when reading from or writing to storage slots. |
CVE-2023-46287 | Medium | 6.1 | 2023-10-20 | XSS exists in NagVis before 1.9.38 via the select function in share/server/core/functions/html.php. |
CVE-2023-5618 | Medium | 6.4 | 2023-10-20 | The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 1.4.16 due… |
CVE-2023-44483 | Medium | 6.5 | 2023-10-20 | All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a priva… |
CVE-2023-44256 | Medium | 6.5 | 2023-10-20 | A server-side request forgery vulnerability [CWE-918] in Fortinet FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 and FortiManager ve… |
CVE-2023-34045 | Medium | 6.6 | 2023-10-20 | VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during installation for the first time (the user needs to dr… |
CVE-2023-34046 | Medium | 6.7 | 2023-10-20 | VMware Fusion(13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during installation for the first time (the user ne… |
CVE-2023-34044 | High | 7.1 | 2023-10-20 | VMware Workstation( 17.x prior to 17.5) and Fusion(13.x prior to 13.5) contain an out-of-bounds read vulnerability that exists in the functionality for sharin… |
CVE-2023-5615 | Medium | 6.4 | 2023-10-20 | The Skype Legacy Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skype-status' shortcode in all versions up to, and… |
CVE-2023-5602 | Medium | 4.3 | 2023-10-20 | The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2… |
CVE-2023-5534 | Medium | 4.3 | 2023-10-20 | The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is due to missing or in… |
CVE-2023-5533 | Medium | 5.3 | 2023-10-20 | The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versio… |
CVE-2023-5337 | Medium | 6.4 | 2023-10-20 | The Contact form Form For All plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions up to, and including, 1… |
CVE-2023-5292 | Medium | 6.4 | 2023-10-20 | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfe_form' shortcode in versions up to, and inc… |
CVE-2023-5231 | Medium | 6.4 | 2023-10-20 | The Magic Action Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.17.2 due to insuffici… |
CVE-2023-5121 | Medium | 4.4 | 2023-10-20 | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings (the backup path parameter) in ve… |
CVE-2023-5109 | Medium | 6.4 | 2023-10-20 | The WP Mailto Links – Protect Email Addresses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wpml_mailto' shortcode in versions up to… |
CVE-2023-5086 | Medium | 6.4 | 2023-10-20 | The Copy Anything to Clipboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'copy' shortcode in versions up to, and including, 2.6.4 d… |
CVE-2023-5070 | Medium | 6.5 | 2023-10-20 | The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2… |
CVE-2023-4999 | High | 8.8 | 2023-10-20 | The Horizontal scrolling announcement plugin for WordPress is vulnerable to SQL Injection via the plugin's [horizontal-scrolling] shortcode in versions up to… |
CVE-2023-4961 | Medium | 6.4 | 2023-10-20 | The Poptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'poptin-form' shortcode in versions up to, and including, 1.3 due to insuffici… |
CVE-2023-4941 | Medium | 4.3 | 2023-10-20 | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe… |
CVE-2023-4926 | Medium | 5.4 | 2023-10-20 | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validat… |
CVE-2023-4924 | Medium | 5.4 | 2023-10-20 | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to missing capability checks on the woobe_… |
CVE-2023-4923 | Medium | 5.4 | 2023-10-20 | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validat… |
CVE-2023-4796 | Medium | 4.3 | 2023-10-20 | The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcj_wp_option' shortcode in versions up to, and including, 7.1.0 due… |
CVE-2023-4668 | Medium | 5.3 | 2023-10-20 | The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL param… |
CVE-2023-4648 | Medium | 4.4 | 2023-10-20 | The WP Customer Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.6.6 due to ins… |
CVE-2023-4386 | High | 8.1 | 2023-10-20 | The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input… |
CVE-2023-4021 | Medium | 4.4 | 2023-10-20 | The Modern Events Calendar lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Google API key and Calendar ID in versions up to, but not… |
CVE-2023-3998 | Medium | 5.3 | 2023-10-20 | The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate function in versions… |
CVE-2023-3996 | Medium | 4.4 | 2023-10-20 | The ARMember Lite - Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.0.16 du… |
CVE-2023-3869 | Medium | 5.3 | 2023-10-20 | The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the voteOnComment function in vers… |
CVE-2023-5576 | High | 8.0 | 2023-10-20 | The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 0.9.91 via Goog… |
CVE-2023-5524 | High | 8.2 | 2023-10-20 | Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execu… |
CVE-2023-5523 | High | 8.6 | 2023-10-20 | Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote… |
CVE-2023-5414 | Critical | 9.1 | 2023-10-20 | The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 via the show_es_logs function. This allo… |
CVE-2023-5308 | Medium | 6.4 | 2023-10-20 | The Podcast Subscribe Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'podcast_subscribe' shortcode in versions up to, and includ… |
CVE-2023-5200 | Medium | 6.4 | 2023-10-20 | The flowpaper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'flipbook' shortcode in versions up to, and including, 2.0.3 due to insuffi… |
CVE-2023-5120 | Medium | 4.4 | 2023-10-20 | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image file path parameter in versions up to… |
CVE-2023-5071 | Medium | 6.4 | 2023-10-20 | The Sitekit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sitekit_iframe' shortcode in versions up to, and including, 1.4 due to insuf… |
CVE-2023-5050 | Medium | 6.4 | 2023-10-20 | The Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.0 due to insufficient in… |
CVE-2023-4975 | Medium | 4.3 | 2023-10-20 | The Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1. This is due to mi… |
CVE-2023-4968 | Medium | 5.5 | 2023-10-20 | The WPLegalPages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wplegalpage' shortcode in versions up to, and including, 2.9.2 due to i… |
CVE-2023-4947 | Medium | 4.3 | 2023-10-20 | The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_or… |
CVE-2023-4943 | Medium | 4.3 | 2023-10-20 | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe… |
CVE-2023-4942 | Medium | 4.3 | 2023-10-20 | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validat… |
CVE-2023-4940 | Medium | 4.3 | 2023-10-20 | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validat… |
CVE-2023-4937 | Medium | 4.3 | 2023-10-20 | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validat… |
CVE-2023-4935 | Medium | 4.3 | 2023-10-20 | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validat… |
CVE-2023-4920 | Medium | 4.3 | 2023-10-20 | The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validat… |
CVE-2023-4919 | Medium | 6.4 | 2023-10-20 | The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `iframe` shortcode in versions up to, and including, 4.6 due to insufficie… |
CVE-2023-4598 | High | 8.8 | 2023-10-20 | The Slimstat Analytics plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 5.0.9 due to insufficie… |
CVE-2023-4488 | Critical | 9.8 | 2023-10-20 | The Dropbox Folder Share for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.7 via the editor-view.php file. This allows… |
CVE-2023-4482 | Medium | 6.4 | 2023-10-20 | The Auto Amazon Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in versions up to, and including, 5.3.1 due to… |
CVE-2023-4402 | High | 8.1 | 2023-10-20 | The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input… |
CVE-2023-4274 | High | 8.7 | 2023-10-20 | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 0.9.89. This allows authen… |
CVE-2023-4271 | Medium | 4.4 | 2023-10-20 | The Photospace Responsive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘psres_button_size’ parameter in versions up to, and includ… |
CVE-2023-39680 | High | 7.5 | 2023-10-20 | Sollace Unicopia version 1.1.1 and before was discovered to deserialize untrusted data, allowing attackers to execute arbitrary code. |
CVE-2023-2325 | High | 7.3 | 2023-10-20 | Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to e… |
CVE-2023-40361 | High | 7.8 | 2023-10-20 | SECUDOS Qiata (DOMOS OS) 4.13 has Insecure Permissions for the previewRm.sh daily cronjob. To exploit this, an attacker needs access as a low-privileged user t… |
CVE-2023-5668 | Medium | 6.4 | 2023-10-20 | The WhatsApp Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'whatsapp' shortcode in all versions up to, and in… |
CVE-2023-5614 | Medium | 6.4 | 2023-10-20 | The Theme Switcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'theme_switcha_list' shortcode in all versions up to, and… |
CVE-2023-5613 | Medium | 6.4 | 2023-10-20 | The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpsscode' shortcode in all versions up to, and inclu… |
CVE-2023-46277 | High | 7.8 | 2023-10-20 | please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this ca… |
CVE-2023-34052 | High | 7.8 | 2023-10-20 | VMware Aria Operations for Logs contains a deserialization vulnerability. A malicious actor with non-administrative access to the local system can trigger the… |
CVE-2023-34051 | Critical | 9.8 | 2023-10-20 | VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system… |
CVE-2023-45471 | Medium | 5.4 | 2023-10-20 | The QAD Search Server is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to, and including, 1.0.0.315 due to insufficient checks on indexes. Thi… |
CVE-2023-45394 | Medium | 5.4 | 2023-10-20 | Stored Cross-Site Scripting (XSS) vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker to store and execute… |
CVE-2023-46115 | High | 8.4 | 2023-10-20 | Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a… |
CVE-2023-41894 | Medium | 5.3 | 2023-10-20 | Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable via the `*.ui.nabu.c… |
CVE-2023-41893 | Medium | 4.3 | 2023-10-20 | Home assistant is an open source home automation. The audit team’s analyses confirmed that the `redirect_uri` and `client_id` are alterable when logging in. Co… |
CVE-2023-39731 | Medium | 5.3 | 2023-10-20 | The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
CVE-2023-44385 | High | 8.6 | 2023-10-19 | The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs t… |
CVE-2023-43345 | High | 8.6 | 2023-10-19 | Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Content… |
CVE-2023-43340 | Medium | 5.2 | 2023-10-19 | Cross-site scripting (XSS) vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmi… |
CVE-2023-41899 | Medium | 6.6 | 2023-10-19 | Home assistant is an open source home automation. In affected versions the `hassio.addon_stdin` is vulnerable to a partial Server-Side Request Forgery where an… |
CVE-2023-41898 | High | 8.6 | 2023-10-19 | Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in… |
CVE-2023-41897 | High | 8.8 | 2023-10-19 | Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which spe… |
CVE-2023-41896 | High | 7.1 | 2023-10-19 | Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected `auth_callback=1`, which is… |