2023 CVEs (page 134)
Page 134 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-45911 | Critical | 9.8 | 2023-10-18 | An issue in WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 allows unauthenticated attackers to login as any user without a password. |
CVE-2023-30911 | Medium | 6.8 | 2023-10-18 | HPE Integrated Lights-Out 5, and Integrated Lights-Out 6 using iLOrest may cause denial of service. |
CVE-2023-20261 | Medium | 6.5 | 2023-10-18 | A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve arbitrary files from an affected syste… |
CVE-2023-5642 | Critical | 9.8 | 2023-10-18 | Advantech R-SeeNet v2.4.23 allows an unauthenticated remote attacker to read from and write to the snmpmon.ini file, which contains sensitive information. |
CVE-2023-46009 | High | 7.8 | 2023-10-18 | gifsicle-1.94 was found to have a floating point exception (FPE) vulnerability via resize_stream at src/xform.c. |
CVE-2023-45383 | High | 7.5 | 2023-10-18 | In the module "SoNice etiquetage" (sonice_etiquetage) up to version 2.5.9 from Common-Services for PrestaShop, a guest can download personal information withou… |
CVE-2023-43250 | High | 7.8 | 2023-10-18 | XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow. There is a User Mode Write AV via a crafted image file. Attackers could exploit this issue for a Denial… |
CVE-2023-5631 | Medium | 6.1 | 2023-10-18 | Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program… |
CVE-2023-45632 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado SpiderVPlayer plugin <= 1.5.22 versions. |
CVE-2023-45630 | Medium | 6.5 | 2023-10-18 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions. |
CVE-2023-45628 | Medium | 6.5 | 2023-10-18 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in QROkes QR Twitter Widget plugin <= 0.2.3 versions. |
CVE-2023-45607 | Medium | 6.5 | 2023-10-18 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Hector Cabrera WordPress Popular Posts plugin <= 6.3.2 versions. |
CVE-2023-45604 | Medium | 5.9 | 2023-10-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Scott Reilly Get Custom Field Values plugin <= 4.0.1 versions. |
CVE-2023-45602 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Shopfiles Ltd Ebook Store plugin <= 5.785 versions. |
CVE-2023-30781 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Theme Blvd Tweeple plugin <= 0.9.5 versions. |
CVE-2023-46007 | Critical | 9.8 | 2023-10-18 | Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_staff.php. |
CVE-2023-46006 | Critical | 9.8 | 2023-10-18 | Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_user.php. |
CVE-2023-46005 | Critical | 9.8 | 2023-10-18 | Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_branch.php. |
CVE-2023-46004 | High | 7.2 | 2023-10-18 | Sourcecodester Best Courier Management System 1.0 is vulnerable to Arbitrary file upload in the update_user function. |
CVE-2023-45608 | Medium | 6.5 | 2023-10-18 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Nicola Modugno Smart Cookie Kit plugin <= 2.3.1 versions. |
CVE-2023-45073 | Medium | 5.9 | 2023-10-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Koch Mendeley Plugin plugin <= 1.3.2 versions. |
CVE-2023-45072 | Medium | 5.9 | 2023-10-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kardi Order auto complete for WooCommerce plugin <= 1.2.0 versions. |
CVE-2023-45071 | High | 7.1 | 2023-10-18 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugi… |
CVE-2023-45070 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder pl… |
CVE-2023-45067 | Medium | 6.5 | 2023-10-18 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions. |
CVE-2023-45065 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mad Fish Digital Bulk NoIndex & NoFollow Toolkit plugin <= 1.42 versions. |
CVE-2023-31217 | Medium | 6.5 | 2023-10-18 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in MyTechTalky User Location and IP plugin <= 1.6 versions. |
CVE-2023-32089 | Medium | 4.6 | 2023-10-18 | Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description |
CVE-2023-32088 | Medium | 4.6 | 2023-10-18 | Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation |
CVE-2023-32087 | Medium | 4.6 | 2023-10-18 | Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation |
CVE-2023-45727 | High | 7.5 | 2023-10-18 | Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier all… |
CVE-2023-5632 | High | 7.5 | 2023-10-18 | In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, w… |
CVE-2023-45064 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Daisuke Takahashi(Extend Wings) OPcache Dashboard plugin <= 0.3.1 versions. |
CVE-2023-45062 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Thomas Scholl canvasio3D Light plugin <= 2.4.6 versions. |
CVE-2023-45059 | Medium | 6.5 | 2023-10-18 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gumroad plugin <= 3.1.0 versions. |
CVE-2023-45057 | Medium | 5.9 | 2023-10-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hitsteps Web Analytics plugin <= 5.86 versions. |
CVE-2023-45056 | Medium | 5.9 | 2023-10-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <= 1.3.26 versions. |
CVE-2023-45054 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AWESOME TOGI Product Category Tree plugin <= 2.5 versions. |
CVE-2023-45051 | Medium | 5.9 | 2023-10-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Image vertical reel scroll slideshow plugin <= 9.0 versions. |
CVE-2023-5621 | Medium | 4.4 | 2023-10-18 | The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions up to, and including… |
CVE-2023-4938 | Medium | 4.3 | 2023-10-18 | The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe… |
CVE-2023-45049 | Medium | 6.5 | 2023-10-18 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <= 4.6.7 versions. |
CVE-2023-45008 | Medium | 5.9 | 2023-10-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPJohnny Comment Reply Email plugin <= 1.0.3 versions. |
CVE-2023-25476 | High | 7.1 | 2023-10-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ezoic AmpedSense – AdSense Split Tester plugin <= 4.68 versions. |
CVE-2023-42319 | High | 7.5 | 2023-10-18 | Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang)… |
CVE-2023-5538 | High | 7.2 | 2023-10-18 | The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and including, 1.0.1 due to… |
CVE-2023-3254 | Medium | 4.3 | 2023-10-18 | The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing… |
CVE-2023-39332 | Critical | 9.8 | 2023-10-18 | Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Arr… |
CVE-2023-39331 | High | 7.5 | 2023-10-18 | A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the imp… |
CVE-2023-38552 | High | 7.5 | 2023-10-18 | When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged… |
CVE-2023-38546 | Low | 3.7 | 2023-10-18 | This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs tr… |
CVE-2023-38545 | Critical | 9.8 | 2023-10-18 | This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow t… |
CVE-2023-35084 | Critical | 9.8 | 2023-10-18 | Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which co… |
CVE-2023-35083 | Medium | 6.5 | 2023-10-18 | Allows an authenticated attacker with network access to read arbitrary files on Endpoint Manager recently discovered on 2022 SU3 and all previous versions pote… |
CVE-2023-5626 | High | 8.8 | 2023-10-18 | Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16. |
CVE-2023-5552 | High | 7.1 | 2023-10-18 | A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version… |
CVE-2023-45811 | High | 8.1 | 2023-10-17 | Synchrony deobfuscator is a javascript cleaner & deobfuscator. A `__proto__` pollution vulnerability exists in versions before v2.4.4. Successful exploitation… |
CVE-2023-45810 | Medium | 5.3 | 2023-10-17 | OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a de… |
CVE-2023-42507 | High | 7.8 | 2023-10-17 | Stack-based buffer overflow vulnerability exists in OnSinView2 versions 2.0.1 and earlier. If this vulnerability is exploited, information may be disclosed or… |
CVE-2023-42506 | High | 7.8 | 2023-10-17 | Improper restriction of operations within the bounds of a memory buffer issue exists in OnSinView2 versions 2.0.1 and earlier. If this vulnerability is exploit… |
CVE-2023-41715 | High | 8.8 | 2023-10-17 | SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileges inside the tunne… |
CVE-2023-41713 | High | 7.5 | 2023-10-17 | SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function. |
CVE-2023-41712 | Medium | 6.5 | 2023-10-17 | SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the SSL VPN plainprefs.exp URL endpoint leads to a firewall crash. |
CVE-2023-41711 | Medium | 6.5 | 2023-10-17 | SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the sonicwall.exp, prefs.exp URL endpoints lead to a firewall crash. |
CVE-2023-3042 | Medium | 5.3 | 2023-10-17 | In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potentially enabling bypasses for XSS and access… |
CVE-2023-39280 | Medium | 6.5 | 2023-10-17 | SonicOS p ost-authentication Stack-Based Buffer Overflow vulnerability in the ssoStats-s.xml, ssoStats-s.wri URL endpoints leads to a firewall crash. |
CVE-2023-39279 | Medium | 6.5 | 2023-10-17 | SonicOS post-authentication Stack-Based Buffer Overflow vulnerability in the getPacketReplayData.json URL endpoint leads to a firewall crash. |
CVE-2023-39278 | Medium | 6.5 | 2023-10-17 | SonicOS post-authentication user assertion failure leads to Stack-Based Buffer Overflow vulnerability via main.cgi leads to a firewall crash. |
CVE-2023-39277 | Medium | 6.5 | 2023-10-17 | SonicOS post-authentication stack-based buffer overflow vulnerability in the sonicflow.csv and appflowsessions.csv URL endpoints leads to a firewall crash. |
CVE-2023-39276 | Medium | 6.5 | 2023-10-17 | SonicOS post-authentication stack-based buffer overflow vulnerability in the getBookmarkList.json URL endpoint leads to a firewall crash. |
CVE-2023-36321 | High | 7.5 | 2023-10-17 | Connected Vehicle Systems Alliance (COVESA) up to v2.18.8 was discovered to contain a buffer overflow via the component /shared/dlt_common.c. |
CVE-2023-41631 | High | 8.8 | 2023-10-17 | eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the file upload function. |
CVE-2023-41630 | Critical | 9.8 | 2023-10-17 | eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the Gii code generator component. |
CVE-2023-41629 | High | 7.5 | 2023-10-17 | A lack of input sanitizing in the file download feature of eSST Monitoring v2.147.1 allows attackers to execute a path traversal. |
CVE-2023-22130 | Medium | 5.9 | 2023-10-17 | Vulnerability in the Sun ZFS Storage Appliance product of Oracle Systems (component: Core). The supported version that is affected is 8.8.60. Difficult to ex… |
CVE-2023-22129 | Medium | 5.5 | 2023-10-17 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerabi… |
CVE-2023-22128 | Low | 3.1 | 2023-10-17 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). Supported versions that are affected are 10 and 11. Difficult to explo… |
CVE-2023-22127 | Medium | 6.3 | 2023-10-17 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Content Access SDK, Image Export SDK, PDF Export SDK, HTML Ex… |
CVE-2023-22126 | Medium | 5.3 | 2023-10-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 12.2… |
CVE-2023-22125 | Medium | 5.4 | 2023-10-17 | Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are a… |
CVE-2023-22124 | Medium | 5.4 | 2023-10-17 | Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are a… |
CVE-2023-22123 | Medium | 5.4 | 2023-10-17 | Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are a… |
CVE-2023-22122 | Medium | 5.9 | 2023-10-17 | Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are a… |
CVE-2023-22121 | Medium | 5.4 | 2023-10-17 | Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are a… |
CVE-2023-22119 | Medium | 5.9 | 2023-10-17 | Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that… |
CVE-2023-22118 | Medium | 6.5 | 2023-10-17 | Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that… |
CVE-2023-22117 | Medium | 5.4 | 2023-10-17 | Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that… |
CVE-2023-22115 | Medium | 4.9 | 2023-10-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.33 and prior. Easily exploita… |
CVE-2023-22114 | Medium | 4.9 | 2023-10-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily ex… |
CVE-2023-22113 | Low | 2.7 | 2023-10-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.33 and prior… |
CVE-2023-22112 | Medium | 4.9 | 2023-10-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily ex… |
CVE-2023-22111 | Medium | 4.9 | 2023-10-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.33 and prior. Easily exploita… |
CVE-2023-22110 | Medium | 4.9 | 2023-10-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily ex… |
CVE-2023-22109 | Medium | 4.6 | 2023-10-17 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Dashboards). Supported versions tha… |
CVE-2023-22108 | High | 7.5 | 2023-10-17 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2023-22107 | Medium | 6.1 | 2023-10-17 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: UI Components). Supported versions that are aff… |
CVE-2023-22106 | Medium | 6.5 | 2023-10-17 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: API). Supported versions that are affected are… |
CVE-2023-22105 | Medium | 5.4 | 2023-10-17 | Vulnerability in the BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 6.4.0.0.0 and 7.0.0.0.0. Easi… |
CVE-2023-22104 | Medium | 4.9 | 2023-10-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.32 and prior. Easily exploitable v… |
CVE-2023-22103 | Medium | 4.9 | 2023-10-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0… |