2023 CVEs (page 136)
Page 136 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-4687 | Medium | 6.1 | 2023-10-16 | The Page Builder: Pagelayer WordPress plugin before 1.7.7 doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled p… |
CVE-2023-4666 | Critical | 9.8 | 2023-10-16 | The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated… |
CVE-2023-4646 | Medium | 5.4 | 2023-10-16 | The Simple Posts Ticker WordPress plugin before 1.1.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post… |
CVE-2023-4643 | High | 8.8 | 2023-10-16 | The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PH… |
CVE-2023-4388 | Medium | 4.8 | 2023-10-16 | The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stor… |
CVE-2023-4290 | Medium | 6.1 | 2023-10-16 | The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes, leading to Reflected C… |
CVE-2023-4289 | Medium | 5.4 | 2023-10-16 | The WP Matterport Shortcode WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/p… |
CVE-2023-45150 | Medium | 4.3 | 2023-10-16 | Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any len… |
CVE-2023-45149 | Medium | 4.3 | 2023-10-16 | Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation passwords can be byp… |
CVE-2023-43121 | High | 7.5 | 2023-10-16 | A Directory Traversal vulnerability discovered in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7, and before 31.7.2 a… |
CVE-2023-43119 | Critical | 9.8 | 2023-10-16 | An Access Control issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, also fixed in 22.7, 31.7.2 allows attackers to gain escalated priv… |
CVE-2023-43118 | High | 8.8 | 2023-10-16 | Cross Site Request Forgery (CSRF) vulnerability in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, fixed in 31.7.2 and 32.5.1.5 al… |
CVE-2023-3746 | Medium | 5.4 | 2023-10-16 | The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform… |
CVE-2023-3707 | Medium | 4.3 | 2023-10-16 | The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticate… |
CVE-2023-3706 | Medium | 4.3 | 2023-10-16 | The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated… |
CVE-2023-3279 | Medium | 4.9 | 2023-10-16 | The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include functio… |
CVE-2023-3155 | High | 7.2 | 2023-10-16 | The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the `g… |
CVE-2023-3154 | High | 7.5 | 2023-10-16 | The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to PHAR Deserialization due to a lack of input parameter validation in the `gallery_edi… |
CVE-2023-29484 | Medium | 6.5 | 2023-10-16 | In Terminalfour before 8.3.16, misconfigured LDAP users are able to login with an invalid password. |
CVE-2023-45683 | High | 7.1 | 2023-10-16 | github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML bi… |
CVE-2023-45669 | Medium | 4.8 | 2023-10-16 | WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to improper signature count… |
CVE-2023-45660 | Medium | 4.3 | 2023-10-16 | Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacke… |
CVE-2023-45151 | Medium | 6.5 | 2023-10-16 | Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gaine… |
CVE-2023-45148 | Medium | 4.3 | 2023-10-16 | Nextcloud is an open source home cloud server. When Memcached is used as `memcache.distributed` the rate limiting in Nextcloud Server could be reset unexpected… |
CVE-2023-43120 | High | 8.8 | 2023-10-16 | An issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7 and before 31.7.1 allows attackers to gain escalated privileges via c… |
CVE-2023-40180 | High | 7.5 | 2023-10-16 | silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Dist… |
CVE-2023-45985 | High | 7.5 | 2023-10-16 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 were discovered to contain a stack overflow in the function setParentalRules… |
CVE-2023-45984 | Critical | 9.8 | 2023-10-16 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the lang parameter in the func… |
CVE-2023-45690 | Medium | 4.9 | 2023-10-16 | Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive… |
CVE-2023-45689 | Medium | 6.5 | 2023-10-16 | Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker with adm… |
CVE-2023-45688 | Medium | 4.3 | 2023-10-16 | Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the size of a… |
CVE-2023-45687 | High | 8.8 | 2023-10-16 | A session fixation vulnerability in South River Technologies' Titan MFT and Titan SFTP servers on Linux and Windows allows an attacker to bypass the server's a… |
CVE-2023-45686 | High | 7.2 | 2023-10-16 | Insufficient path validation when writing a file via WebDAV in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated atta… |
CVE-2023-45685 | Critical | 9.1 | 2023-10-16 | Insufficient path validation when extracting a zip archive in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authent… |
CVE-2023-20198 | Critical | 10.0 | 2023-10-16 | Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list… |
CVE-2023-46087 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Mahlamusa Who Hit The Page – Hit Counter plugin <= 1.4.14.3 versions. |
CVE-2023-5575 | Medium | 6.5 | 2023-10-16 | Improper access control in the permission inheritance in Devolutions Server 2022.3.13.0 and earlier allows an attacker that compromised a low privileged user… |
CVE-2023-46066 | Medium | 5.9 | 2023-10-16 | Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Codedrafty Mediabay – Media Library Folders plugin <= 1.6 versions. |
CVE-2023-44987 | Medium | 5.9 | 2023-10-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Timely - Appointment software Timely Booking Button plugin <= 2.0.2 versions. |
CVE-2023-45836 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in XYDAC Ultimate Taxonomy Manager plugin <= 2.0 versions. |
CVE-2023-45831 | Medium | 5.4 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Pixelative, Mohsin Rafique AMP WP – Google AMP For WordPress plugin <= 1.5.15 versions. |
CVE-2023-45763 | Medium | 5.4 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Taggbox plugin <= 2.9 versions. |
CVE-2023-45753 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Gilles Dumas which template file plugin <= 4.6.0 versions. |
CVE-2023-45752 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in 10 Quality Post Gallery plugin <= 2.3.12 versions. |
CVE-2023-45749 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Alexey Golubnichenko AGP Font Awesome Collection plugin <= 3.2.4 versions. |
CVE-2023-45748 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailChimp Forms by MailMunch plugin <= 3.1.4 versions. |
CVE-2023-44986 | Medium | 5.9 | 2023-10-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Abandoned Cart Lite for WooCommerce plugin <= 5.15.2 versions. |
CVE-2023-44985 | Medium | 6.5 | 2023-10-16 | Auth. (contributo+) Stored Cross-Site Scripting (XSS) vulnerability in Cytech BuddyMeet plugin <= 2.2.0 versions. |
CVE-2023-44984 | Medium | 6.5 | 2023-10-16 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Robin Wilson bbp style pack plugin <= 5.6.7 versions. |
CVE-2023-44229 | Medium | 5.9 | 2023-10-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Tiny Carousel Horizontal Slider plugin <= 8.1 versions. |
CVE-2023-4457 | Medium | 5.5 | 2023-10-16 | Grafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable… |
CVE-2023-45647 | Medium | 5.4 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in MailMunch Constant Contact Forms by MailMunch plugin <= 2.0.10 versions. |
CVE-2023-45645 | Medium | 5.4 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in InfoD74 WP Open Street Map plugin <= 1.25 versions. |
CVE-2023-45643 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Anurag Deshmukh CPT Shortcode Generator plugin <= 1.0 versions. |
CVE-2023-45642 | Medium | 5.4 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Hassan Ali Snap Pixel plugin <= 1.5.7 versions. |
CVE-2023-45641 | Medium | 5.4 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Caret Inc. Caret Country Access Limit plugin <= 1.0.2 versions. |
CVE-2023-45639 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Codex-m Sort SearchResult By Title plugin <= 10.0 versions. |
CVE-2023-3991 | Critical | 10.0 | 2023-10-16 | An OS command injection vulnerability exists in the httpd iperfrun.cgi functionality of FreshTomato 2023.3. A specially crafted HTTP request can lead to arbitr… |
CVE-2023-5595 | Medium | 5.5 | 2023-10-16 | Denial of Service in GitHub repository gpac/gpac prior to 2.3.0-DEV. |
CVE-2023-5422 | High | 8.7 | 2023-10-16 | The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSL_get_verify… |
CVE-2023-5421 | Low | 3.5 | 2023-10-16 | An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScrip… |
CVE-2023-4834 | Medium | 4.3 | 2023-10-16 | In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validatio… |
CVE-2023-4827 | High | 8.8 | 2023-10-16 | The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attackers to make highly… |
CVE-2023-4822 | Medium | 6.7 | 2023-10-16 | Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user… |
CVE-2023-4620 | Medium | 6.1 | 2023-10-16 | The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stor… |
CVE-2023-45757 | Medium | 6.1 | 2023-10-16 | Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page. An attacker that can send http req… |
CVE-2023-45656 | Medium | 5.4 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Kevin Weber Lazy Load for Videos plugin <= 2.18.2 versions. |
CVE-2023-45655 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in PixelGrade PixFields plugin <= 0.7.0 versions. |
CVE-2023-45654 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions. |
CVE-2023-45653 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Galaxy Weblinks Video Playlist For YouTube plugin <= 6.0 versions. |
CVE-2023-45651 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi WP Attachments allows Cross Site Request Forgery.This issue affects WP Attachments: from n/a th… |
CVE-2023-45650 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Fla-shop.Com HTML5 Maps plugin <= 1.7.1.4 versions. |
CVE-2023-45638 | Medium | 6.5 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in euPago Eupago Gateway For Woocommerce plugin <= 3.1.9 versions. |
CVE-2023-45629 | Medium | 5.4 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions. |
CVE-2023-45606 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Lasso Simple URLs plugin <= 120 versions. |
CVE-2023-45605 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Christopher Finke Feed Statistics plugin <= 4.1 versions. |
CVE-2023-45274 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in SendPulse SendPulse Free Web Push plugin <= 1.3.1 versions. |
CVE-2023-45273 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Matt McKenny Stout Google Calendar plugin <= 1.2.3 versions. |
CVE-2023-43668 | Critical | 9.8 | 2023-10-16 | Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive pa… |
CVE-2023-43667 | High | 7.5 | 2023-10-16 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue affects Apache InL… |
CVE-2023-43666 | Medium | 6.5 | 2023-10-16 | Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, General user can vi… |
CVE-2023-3392 | High | 7.2 | 2023-10-16 | The Read More & Accordion WordPress plugin before 3.2.7 unserializes user input provided via the settings, which could allow high-privilege users such as admin… |
CVE-2023-38059 | Medium | 5.3 | 2023-10-16 | The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the… |
CVE-2023-45158 | Critical | 9.8 | 2023-10-16 | An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default… |
CVE-2023-45580 | Critical | 9.8 | 2023-10-16 | Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-72… |
CVE-2023-45579 | Critical | 9.8 | 2023-10-16 | Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-72… |
CVE-2023-45578 | Critical | 9.8 | 2023-10-16 | Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-72… |
CVE-2023-45577 | Critical | 9.8 | 2023-10-16 | Stack Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-720… |
CVE-2023-45576 | Critical | 9.8 | 2023-10-16 | Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-72… |
CVE-2023-21415 | Medium | 6.5 | 2023-10-16 | Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for fi… |
CVE-2023-21414 | High | 7.1 | 2023-10-16 | NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. The protection for device tampering (commonly known as S… |
CVE-2023-21413 | Critical | 9.1 | 2023-10-16 | GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on the Axis device. Th… |
CVE-2023-45575 | Critical | 9.8 | 2023-10-16 | Stack Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-720… |
CVE-2023-45574 | Critical | 9.8 | 2023-10-16 | Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-72… |
CVE-2023-45573 | Critical | 9.8 | 2023-10-16 | Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-72… |
CVE-2023-45572 | Critical | 9.8 | 2023-10-16 | Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-72… |
CVE-2023-44809 | Critical | 9.8 | 2023-10-16 | D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions. |
CVE-2023-44808 | Critical | 9.8 | 2023-10-16 | D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_4507CC function. |
CVE-2023-36955 | Critical | 9.8 | 2023-10-16 | TOTOLINK CP300+ <=V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule. |
CVE-2023-36954 | Critical | 9.8 | 2023-10-16 | TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection. |