2023 CVEs (page 135)
Page 135 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-27132 | Critical | 9.8 | 2023-10-17 | TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the HTML source code for the secure single sign-on web portal. NOTE: CVE-2023… |
CVE-2023-37537 | High | 7.8 | 2023-10-17 | An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gai… |
CVE-2023-45907 | High | 8.8 | 2023-10-17 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/delete. |
CVE-2023-45906 | High | 8.8 | 2023-10-17 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/user/add. |
CVE-2023-45905 | High | 8.8 | 2023-10-17 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/add. |
CVE-2023-45904 | High | 8.8 | 2023-10-17 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /variable/update. |
CVE-2023-45903 | High | 8.8 | 2023-10-17 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/label/delete. |
CVE-2023-45902 | High | 8.8 | 2023-10-17 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/attachment/delete. |
CVE-2023-45901 | High | 8.8 | 2023-10-17 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin\/category\/add. |
CVE-2023-43959 | High | 8.8 | 2023-10-17 | An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote privileged attacker to execute arbitrary code via a crafted request the ping function of the diagno… |
CVE-2023-20598 | High | 7.8 | 2023-10-17 | An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over a… |
CVE-2023-44824 | High | 7.8 | 2023-10-17 | An issue in Expense Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted file uploaded to the sign-up.php component. |
CVE-2023-43777 | Medium | 5.9 | 2023-10-17 | Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays. T… |
CVE-2023-43776 | Medium | 6.8 | 2023-10-17 | Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the… |
CVE-2023-42627 | Critical | 9.6 | 2023-10-17 | Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and e… |
CVE-2023-45007 | High | 7.1 | 2023-10-17 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fotomoto plugin <= 1.2.8 versions. |
CVE-2023-45006 | High | 7.1 | 2023-10-17 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ByConsole WooODT Lite – WooCommerce Order Delivery or Pickup with Date Time Location plugin <= 2… |
CVE-2023-45004 | High | 7.1 | 2023-10-17 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wp3sixty Woo Custom Emails plugin <= 2.2 versions. |
CVE-2023-42628 | Critical | 9.0 | 2023-10-17 | Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 f… |
CVE-2023-39902 | High | 7.0 | 2023-10-17 | A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before 2023.07 on select NXP i.MX 8M family processors. Under certain… |
CVE-2023-45010 | Medium | 5.9 | 2023-10-17 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alex MacArthur Complete Open Graph plugin <= 3.4.5 versions. |
CVE-2023-45003 | High | 7.1 | 2023-10-17 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Arrow Plugins Social Feed | Custom Feed for Social Media Networks plugin <= 2.2.0 versions. |
CVE-2023-5522 | Medium | 4.3 | 2023-10-17 | Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojis to a channel and… |
CVE-2023-5339 | Medium | 4.7 | 2023-10-17 | Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password ent… |
CVE-2023-45005 | High | 7.1 | 2023-10-17 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Castos Seriously Simple Stats plugin <= 1.5.1 versions. |
CVE-2023-44990 | Medium | 5.9 | 2023-10-17 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7.1 vers… |
CVE-2023-44311 | Critical | 9.6 | 2023-10-17 | Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7… |
CVE-2023-44310 | Critical | 9.0 | 2023-10-17 | Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and… |
CVE-2023-44309 | Critical | 9.0 | 2023-10-17 | Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay DXP 7.4 before upda… |
CVE-2023-42629 | Critical | 9.0 | 2023-10-17 | Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 al… |
CVE-2023-24385 | Medium | 5.9 | 2023-10-17 | Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in David Lingren Media Library Assistant plugin <= 3.11 versions. |
CVE-2023-4399 | Medium | 6.6 | 2023-10-17 | Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure G… |
CVE-2023-42497 | Critical | 9.6 | 2023-10-17 | Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before up… |
CVE-2023-4089 | Low | 2.7 | 2023-10-17 | On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local fi… |
CVE-2023-41752 | High | 7.5 | 2023-10-17 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through… |
CVE-2023-39456 | High | 7.5 | 2023-10-17 | Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2… |
CVE-2023-44694 | Critical | 9.8 | 2023-10-17 | D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /log/mailrecvview.php. |
CVE-2023-44693 | Critical | 9.8 | 2023-10-17 | D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php. |
CVE-2023-45386 | Critical | 9.8 | 2023-10-17 | In the module extratabspro before version 2.2.8 from MyPresta.eu for PrestaShop, a guest can perform SQL injection via `extratabspro::searchcategory()`, `extra… |
CVE-2023-45375 | High | 8.8 | 2023-10-17 | In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL injection via `PireosPayValidationModu… |
CVE-2023-45358 | High | 8.5 | 2023-10-17 | Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user co… |
CVE-2023-45357 | Medium | 4.3 | 2023-10-17 | Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obta… |
CVE-2023-34210 | High | 7.7 | 2023-10-17 | SQL Injection in create customer group function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to execute arbitrary SQL comma… |
CVE-2023-34209 | Medium | 5.0 | 2023-10-17 | Exposure of Sensitive System Information to an Unauthorized Control Sphere in create template function in EasyUse MailHunter Ultimate 2023 and earlier allow re… |
CVE-2023-34208 | Medium | 6.5 | 2023-10-17 | Path Traversal in create template function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to extract files into arbitrary dir… |
CVE-2023-34207 | Critical | 9.9 | 2023-10-17 | Unrestricted upload of file with dangerous type vulnerability in create template function in EasyUse MailHunter Ultimate 2023 and earlier allows remote authent… |
CVE-2023-4215 | Medium | 6.5 | 2023-10-17 | Advantech WebAccess version 9.1.3 contains an exposure of sensitive information to an unauthorized actor vulnerability that could leak user credentials. |
CVE-2023-45659 | Low | 3.6 | 2023-10-17 | Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged i… |
CVE-2023-45152 | Low | 2.0 | 2023-10-17 | Engelsystem is a shift planning system for chaos events. A Blind SSRF in the "Import schedule" functionality makes it possible to perform a port scan against t… |
CVE-2023-40373 | Medium | 5.3 | 2023-10-17 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to denial of service with a specially crafted query containing common table exp… |
CVE-2023-40372 | Medium | 5.3 | 2023-10-17 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted SQL statement using External… |
CVE-2023-38719 | Medium | 5.1 | 2023-10-17 | IBM Db2 11.5 could allow a local user with special privileges to cause a denial of service during database deactivation on DPF. IBM X-Force ID: 261607. |
CVE-2023-40374 | Medium | 5.3 | 2023-10-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted query statement. IBM X-Forc… |
CVE-2023-30991 | High | 7.5 | 2023-10-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force… |
CVE-2023-45807 | Medium | 5.4 | 2023-10-16 | OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implement… |
CVE-2023-45540 | Medium | 6.5 | 2023-10-16 | An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List… |
CVE-2023-45131 | High | 7.5 | 2023-10-16 | Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issu… |
CVE-2023-44394 | Medium | 4.3 | 2023-10-16 | MantisBT is an open source bug tracker. Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by a… |
CVE-2023-44391 | Medium | 5.3 | 2023-10-16 | Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even when `hide_user_profiles_from_public` is… |
CVE-2023-44388 | High | 7.5 | 2023-10-16 | Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the ser… |
CVE-2023-43814 | Low | 3.7 | 2023-10-16 | Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grouped_poll_results` e… |
CVE-2023-43659 | High | 8.0 | 2023-10-16 | Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email pr… |
CVE-2023-43658 | High | 8.0 | 2023-10-16 | dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Improper e… |
CVE-2023-38740 | Medium | 5.3 | 2023-10-16 | IBM Db2 for Linux, UNIX, and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a specially crafted SQL statement. IBM X-For… |
CVE-2023-38728 | Medium | 5.3 | 2023-10-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted XML query st… |
CVE-2023-45542 | Medium | 6.1 | 2023-10-16 | Cross Site Scripting vulnerability in mooSocial 3.1.8 allows a remote attacker to obtain sensitive information via a crafted script to the q parameter in the S… |
CVE-2023-45147 | Medium | 4.9 | 2023-10-16 | Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of th… |
CVE-2023-45144 | Critical | 10.0 | 2023-10-16 | com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in vi… |
CVE-2023-45141 | High | 8.6 | 2023-10-16 | Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allow… |
CVE-2023-45128 | Critical | 10.0 | 2023-10-16 | Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allow… |
CVE-2023-42459 | High | 8.6 | 2023-10-16 | Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA subme… |
CVE-2023-40852 | Critical | 9.8 | 2023-10-16 | SQL Injection vulnerability in Phpgurukul User Registration & Login and User Management System With admin panel 3.0 allows attackers to obtain sensitive inform… |
CVE-2023-40851 | Medium | 5.4 | 2023-10-16 | Cross Site Scripting (XSS) vulnerability in Phpgurukul User Registration & Login and User Management System With admin panel 3.0 allows attackers to run arbitr… |
CVE-2023-38720 | Medium | 5.3 | 2023-10-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 and 11.5 is vulnerable to denial of service with a specially crafted ALTER TABLE stateme… |
CVE-2023-30987 | Medium | 5.3 | 2023-10-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on cer… |
CVE-2023-5561 | Medium | 5.3 | 2023-10-16 | WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of us… |
CVE-2023-5177 | Medium | 5.3 | 2023-10-16 | The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 exposes the full path of a file when putting in a non-existent file in a parameter of the shortcode. |
CVE-2023-5167 | Medium | 5.4 | 2023-10-16 | The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activity logs dashboard, which may allow visi… |
CVE-2023-5133 | High | 7.5 | 2023-10-16 | This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate i… |
CVE-2023-5089 | Medium | 5.3 | 2023-10-16 | The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthen… |
CVE-2023-5087 | Medium | 5.4 | 2023-10-16 | The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript insid… |
CVE-2023-5057 | Medium | 5.4 | 2023-10-16 | The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contribu… |
CVE-2023-5003 | High | 7.5 | 2023-10-16 | The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to e… |
CVE-2023-4971 | High | 7.2 | 2023-10-16 | The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues wh… |
CVE-2023-4950 | Medium | 6.1 | 2023-10-16 | The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenti… |
CVE-2023-4933 | Medium | 5.3 | 2023-10-16 | The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allow… |
CVE-2023-4862 | Medium | 4.8 | 2023-10-16 | The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege users. |
CVE-2023-4861 | High | 7.2 | 2023-10-16 | The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to g… |
CVE-2023-4821 | Medium | 5.4 | 2023-10-16 | The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.1 does not filter all potentially dangerous file extensions. Therefore, an a… |
CVE-2023-4820 | Medium | 5.4 | 2023-10-16 | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users… |
CVE-2023-4819 | Medium | 6.1 | 2023-10-16 | The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload… |
CVE-2023-4811 | Medium | 5.4 | 2023-10-16 | The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege users such as cont… |
CVE-2023-4805 | Medium | 5.4 | 2023-10-16 | The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cro… |
CVE-2023-4800 | Medium | 6.5 | 2023-10-16 | The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users. |
CVE-2023-4798 | Medium | 5.4 | 2023-10-16 | The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-priv… |
CVE-2023-4795 | Medium | 5.4 | 2023-10-16 | The Testimonial Slider Shortcode WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the… |
CVE-2023-4783 | Medium | 5.4 | 2023-10-16 | The Magee Shortcodes WordPress plugin through 2.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wh… |
CVE-2023-4776 | High | 8.8 | 2023-10-16 | The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare t… |
CVE-2023-4725 | Medium | 4.8 | 2023-10-16 | The Simple Posts Ticker WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2023-4691 | High | 7.2 | 2023-10-16 | The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.4 does not properly sanitise and escape a parameter before using it in a SQL stat… |