2023 CVEs (page 133)
Page 133 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-35186 | High | 8.0 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWind… |
CVE-2023-35185 | Medium | 6.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability using SYSTEM privileges. |
CVE-2023-35184 | High | 8.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse a Solar… |
CVE-2023-35183 | High | 7.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows authenticated users to abuse local resour… |
CVE-2023-35182 | High | 8.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability can be abused by unauthenticated users on Solar… |
CVE-2023-35181 | High | 7.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows users to abuse incorrect folder permissio… |
CVE-2023-35180 | High | 8.0 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows authenticated users to abuse SolarWinds… |
CVE-2023-31046 | Medium | 6.5 | 2023-10-19 | A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an au… |
CVE-2023-45883 | High | 7.8 | 2023-10-19 | A privilege escalation vulnerability exists within the Qumu Multicast Extension v2 before 2.0.63 for Windows. When a standard user triggers a repair of the sof… |
CVE-2023-45384 | Critical | 9.8 | 2023-10-19 | KnowBand supercheckout > 5.0.7 and < 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module "Module One Page Checkout, Social Lo… |
CVE-2023-45379 | Critical | 9.8 | 2023-10-19 | In the module "Rotator Img" (posrotatorimg) in versions at least up to 1.1 from PosThemes for PrestaShop, a guest can perform SQL injection. |
CVE-2023-43252 | High | 7.8 | 2023-10-19 | XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow via a crafted image file. |
CVE-2023-46227 | High | 7.5 | 2023-10-19 | Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the… |
CVE-2023-25753 | Medium | 6.5 | 2023-10-19 | There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arb… |
CVE-2023-34050 | Medium | 5.0 | 2023-10-19 | In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing… |
CVE-2023-5254 | Medium | 5.3 | 2023-10-19 | The ChatBot plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.8.9 via the qcld_wb_chatbot_check_user fun… |
CVE-2023-5241 | Critical | 9.6 | 2023-10-19 | The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 as well as 4.9.2 via the qcld_openai_upload_pagetrain… |
CVE-2023-5212 | Critical | 9.6 | 2023-10-19 | The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 4.8.9 as well as version 4.9.2. This makes it po… |
CVE-2023-5204 | Critical | 9.8 | 2023-10-19 | The ChatBot plugin for WordPress is vulnerable to SQL Injection via the $strid parameter in versions up to, and including, 4.8.9 due to insufficient escaping o… |
CVE-2023-46229 | High | 8.8 | 2023-10-19 | LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server. |
CVE-2023-46228 | High | 7.8 | 2023-10-19 | zchunk before 1.3.2 has multiple integer overflows via malformed zchunk files to lib/comp/comp.c, lib/comp/zstd/zstd.c, lib/dl/multipart.c, or lib/header.c. |
CVE-2023-37503 | High | 8.1 | 2023-10-19 | HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts. |
CVE-2023-5639 | Medium | 6.4 | 2023-10-19 | The Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tmfshortcode' shortcode in all versions up to, and includ… |
CVE-2023-5638 | Medium | 6.4 | 2023-10-19 | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcj_image' shortcode in versions up to, and including, 7.1.2… |
CVE-2023-5336 | High | 8.8 | 2023-10-19 | The iPanorama 360 – WordPress Virtual Tour Builder plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and includ… |
CVE-2023-4645 | Medium | 5.3 | 2023-10-19 | The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai_ajax function. This can allow… |
CVE-2023-37504 | High | 7.1 | 2023-10-19 | HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is calle… |
CVE-2023-36857 | Medium | 5.4 | 2023-10-19 | Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a replay vulnerability which could allow an attacker to replay older captu… |
CVE-2023-34441 | Medium | 6.8 | 2023-10-19 | Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to stea… |
CVE-2023-34437 | High | 7.5 | 2023-10-19 | Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an at… |
CVE-2023-45909 | Medium | 6.1 | 2023-10-18 | zzzcms v2.2.0 was discovered to contain an open redirect vulnerability. |
CVE-2023-37502 | Critical | 9.0 | 2023-10-18 | HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a us… |
CVE-2023-45958 | Medium | 6.1 | 2023-10-18 | Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/Admin… |
CVE-2023-45814 | Medium | 5.3 | 2023-10-18 | Bunkum is an open-source protocol-agnostic request server for custom game servers. First, a little bit of background. So, in the beginning, Bunkum's `Authentic… |
CVE-2023-45812 | High | 7.5 | 2023-10-18 | The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions… |
CVE-2023-45146 | Critical | 9.0 | 2023-10-18 | XXL-RPC is a high performance, distributed RPC framework. With it, a TCP server can be set up using the Netty framework and the Hessian serialization mechanism… |
CVE-2023-43801 | Medium | 6.1 | 2023-10-18 | Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles… |
CVE-2023-43800 | High | 7.3 | 2023-10-18 | Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A user who has the abi… |
CVE-2023-45813 | Medium | 4.6 | 2023-10-18 | Torbot is an open source tor network intelligence tool. In affected versions the `torbot.modules.validators.validate_link function` uses the python-validators… |
CVE-2023-45145 | Low | 3.6 | 2023-10-18 | Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided… |
CVE-2023-43803 | Medium | 6.1 | 2023-10-18 | Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles… |
CVE-2023-43802 | High | 7.1 | 2023-10-18 | Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/upload` which handles request with the `filenam… |
CVE-2023-4601 | High | 8.1 | 2023-10-18 | A stack-based buffer overflow vulnerability exists in NI System Configuration that could result in information disclosure and/or arbitrary code execution. Succ… |
CVE-2023-35663 | High | 7.5 | 2023-10-18 | In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclo… |
CVE-2023-35656 | High | 7.5 | 2023-10-18 | In multiple functions of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote inf… |
CVE-2023-26300 | High | 7.8 | 2023-10-18 | A potential security vulnerability has been identified in the system BIOS for certain HP PC products which might allow escalation of privilege. HP is releasing… |
CVE-2023-45912 | High | 7.5 | 2023-10-18 | WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 fails to validate user sessions, allowing unauthenticated attackers to read files from the underlying opera… |
CVE-2023-45911 | Critical | 9.8 | 2023-10-18 | An issue in WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 allows unauthenticated attackers to login as any user without a password. |
CVE-2023-30911 | Medium | 6.8 | 2023-10-18 | HPE Integrated Lights-Out 5, and Integrated Lights-Out 6 using iLOrest may cause denial of service. |
CVE-2023-20261 | Medium | 6.5 | 2023-10-18 | A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve arbitrary files from an affected syste… |
CVE-2023-5642 | Critical | 9.8 | 2023-10-18 | Advantech R-SeeNet v2.4.23 allows an unauthenticated remote attacker to read from and write to the snmpmon.ini file, which contains sensitive information. |
CVE-2023-46009 | High | 7.8 | 2023-10-18 | gifsicle-1.94 was found to have a floating point exception (FPE) vulnerability via resize_stream at src/xform.c. |
CVE-2023-45383 | High | 7.5 | 2023-10-18 | In the module "SoNice etiquetage" (sonice_etiquetage) up to version 2.5.9 from Common-Services for PrestaShop, a guest can download personal information withou… |
CVE-2023-43250 | High | 7.8 | 2023-10-18 | XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow. There is a User Mode Write AV via a crafted image file. Attackers could exploit this issue for a Denial… |
CVE-2023-5631 | Medium | 6.1 | 2023-10-18 | Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program… |
CVE-2023-45632 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado SpiderVPlayer plugin <= 1.5.22 versions. |
CVE-2023-45630 | Medium | 6.5 | 2023-10-18 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions. |
CVE-2023-45628 | Medium | 6.5 | 2023-10-18 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in QROkes QR Twitter Widget plugin <= 0.2.3 versions. |
CVE-2023-45607 | Medium | 6.5 | 2023-10-18 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Hector Cabrera WordPress Popular Posts plugin <= 6.3.2 versions. |
CVE-2023-45604 | Medium | 5.9 | 2023-10-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Scott Reilly Get Custom Field Values plugin <= 4.0.1 versions. |
CVE-2023-45602 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Shopfiles Ltd Ebook Store plugin <= 5.785 versions. |
CVE-2023-30781 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Theme Blvd Tweeple plugin <= 0.9.5 versions. |
CVE-2023-46007 | Critical | 9.8 | 2023-10-18 | Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_staff.php. |
CVE-2023-46006 | Critical | 9.8 | 2023-10-18 | Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_user.php. |
CVE-2023-46005 | Critical | 9.8 | 2023-10-18 | Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_branch.php. |
CVE-2023-46004 | High | 7.2 | 2023-10-18 | Sourcecodester Best Courier Management System 1.0 is vulnerable to Arbitrary file upload in the update_user function. |
CVE-2023-45608 | Medium | 6.5 | 2023-10-18 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Nicola Modugno Smart Cookie Kit plugin <= 2.3.1 versions. |
CVE-2023-45073 | Medium | 5.9 | 2023-10-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Koch Mendeley Plugin plugin <= 1.3.2 versions. |
CVE-2023-45072 | Medium | 5.9 | 2023-10-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kardi Order auto complete for WooCommerce plugin <= 1.2.0 versions. |
CVE-2023-45071 | High | 7.1 | 2023-10-18 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugi… |
CVE-2023-45070 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder pl… |
CVE-2023-45067 | Medium | 6.5 | 2023-10-18 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions. |
CVE-2023-45065 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mad Fish Digital Bulk NoIndex & NoFollow Toolkit plugin <= 1.42 versions. |
CVE-2023-31217 | Medium | 6.5 | 2023-10-18 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in MyTechTalky User Location and IP plugin <= 1.6 versions. |
CVE-2023-32089 | Medium | 4.6 | 2023-10-18 | Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description |
CVE-2023-32088 | Medium | 4.6 | 2023-10-18 | Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation |
CVE-2023-32087 | Medium | 4.6 | 2023-10-18 | Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation |
CVE-2023-45727 | High | 7.5 | 2023-10-18 | Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier all… |
CVE-2023-5632 | High | 7.5 | 2023-10-18 | In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, w… |
CVE-2023-45064 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Daisuke Takahashi(Extend Wings) OPcache Dashboard plugin <= 0.3.1 versions. |
CVE-2023-45062 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Thomas Scholl canvasio3D Light plugin <= 2.4.6 versions. |
CVE-2023-45059 | Medium | 6.5 | 2023-10-18 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gumroad plugin <= 3.1.0 versions. |
CVE-2023-45057 | Medium | 5.9 | 2023-10-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hitsteps Web Analytics plugin <= 5.86 versions. |
CVE-2023-45056 | Medium | 5.9 | 2023-10-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <= 1.3.26 versions. |
CVE-2023-45054 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AWESOME TOGI Product Category Tree plugin <= 2.5 versions. |
CVE-2023-45051 | Medium | 5.9 | 2023-10-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Image vertical reel scroll slideshow plugin <= 9.0 versions. |
CVE-2023-5621 | Medium | 4.4 | 2023-10-18 | The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions up to, and including… |
CVE-2023-4938 | Medium | 4.3 | 2023-10-18 | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe… |
CVE-2023-45049 | Medium | 6.5 | 2023-10-18 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <= 4.6.7 versions. |
CVE-2023-45008 | Medium | 5.9 | 2023-10-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPJohnny Comment Reply Email plugin <= 1.0.3 versions. |
CVE-2023-25476 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ezoic AmpedSense – AdSense Split Tester plugin <= 4.68 versions. |
CVE-2023-42319 | High | 7.5 | 2023-10-18 | Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang)… |
CVE-2023-5538 | High | 7.2 | 2023-10-18 | The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and including, 1.0.1 due to… |
CVE-2023-3254 | Medium | 4.3 | 2023-10-18 | The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing… |
CVE-2023-39332 | Critical | 9.8 | 2023-10-18 | Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Arr… |
CVE-2023-39331 | High | 7.5 | 2023-10-18 | A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the imp… |
CVE-2023-38552 | High | 7.5 | 2023-10-18 | When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged… |
CVE-2023-38546 | Low | 3.7 | 2023-10-18 | This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs tr… |
CVE-2023-38545 | Critical | 9.8 | 2023-10-18 | This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow t… |
CVE-2023-35084 | Critical | 9.8 | 2023-10-18 | Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which co… |