2023 CVEs (page 137)
Page 137 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-36953 | Critical | 9.8 | 2023-10-16 | TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection. |
CVE-2023-36950 | Critical | 9.8 | 2023-10-16 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the http_host parameter in the… |
CVE-2023-36952 | Critical | 9.8 | 2023-10-16 | TOTOLINK CP300+ V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the pingIp parameter in the function setDiagnosisCfg. |
CVE-2023-36947 | Critical | 9.8 | 2023-10-16 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File parameter in the func… |
CVE-2023-36340 | Critical | 9.8 | 2023-10-16 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth. |
CVE-2023-45898 | High | 7.8 | 2023-10-16 | The Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extents_status.c, related to ext4_es_insert_extent. |
CVE-2023-40791 | Medium | 6.3 | 2023-10-16 | extract_user_to_sg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails to unpin pages in a certain situation, as demonstrated by a WARNING for try_gra… |
CVE-2023-38280 | High | 8.4 | 2023-10-16 | IBM HMC (Hardware Management Console) 10.1.1010.0 and 10.2.1030.0 could allow a local user to escalate their privileges to root access on a restricted shell… |
CVE-2023-5591 | Medium | 6.5 | 2023-10-16 | SQL Injection in GitHub repository librenms/librenms prior to 23.10.0. |
CVE-2023-40377 | Medium | 4.9 | 2023-10-16 | Backup, Recovery, and Media Services (BRMS) for IBM i 7.2, 7.3, and 7.4 contains a local privilege escalation vulnerability. A malicious actor with command li… |
CVE-2023-33836 | Medium | 5.3 | 2023-10-16 | IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2023-35018 | Low | 3.3 | 2023-10-16 | IBM Security Verify Governance 10.0 could allow a privileged use to upload arbitrary files due to improper file validation. IBM X-Force ID: 259382. |
CVE-2023-35013 | Low | 2.3 | 2023-10-16 | IBM Security Verify Governance 10.0, Identity Manager could allow a local privileged user to obtain sensitive information from source code. IBM X-Force ID: 2… |
CVE-2023-5590 | High | 7.5 | 2023-10-15 | NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.0. |
CVE-2023-5589 | High | 7.3 | 2023-10-15 | A vulnerability was found in SourceCodester Judging Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2023-5588 | Low | 2.6 | 2023-10-15 | A vulnerability was found in kphrx pleroma. It has been classified as problematic. This affects the function Pleroma.Emoji.Pack of the file lib/pleroma/emoji/p… |
CVE-2023-5587 | Medium | 6.3 | 2023-10-15 | A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0 and classified as critical. Affected by this issue is some… |
CVE-2023-38312 | High | 7.5 | 2023-10-15 | A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client (with remote control access to a game server) to read arbitrary files from the… |
CVE-2023-40378 | Medium | 4.9 | 2023-10-15 | IBM Directory Server for IBM i contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system ca… |
CVE-2023-5586 | High | 7.8 | 2023-10-15 | NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3.0-DEV. |
CVE-2023-45871 | High | 7.5 | 2023-10-15 | An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for… |
CVE-2023-5585 | Low | 2.4 | 2023-10-15 | A vulnerability was found in SourceCodester Online Motorcycle Rental System 1.0. It has been declared as problematic. This vulnerability affects unknown code o… |
CVE-2023-45863 | Medium | 6.4 | 2023-10-14 | An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_ko… |
CVE-2023-45862 | Medium | 5.5 | 2023-10-14 | An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially exte… |
CVE-2023-40367 | Medium | 5.4 | 2023-10-14 | IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the… |
CVE-2023-30994 | Medium | 5.4 | 2023-10-14 | IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID… |
CVE-2023-45176 | Medium | 6.2 | 2023-10-14 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.10.0 and IBM Integration Bus 10.1 through 10.1.0.1 are vulnerable to a denial of s… |
CVE-2023-35024 | Medium | 4.6 | 2023-10-14 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vul… |
CVE-2023-5582 | Low | 3.5 | 2023-10-14 | A vulnerability, which was classified as problematic, has been found in ZZZCMS 2.2.0. This issue affects some unknown processing of the component Personal Prof… |
CVE-2023-5581 | Low | 3.5 | 2023-10-14 | A vulnerability classified as problematic was found in SourceCodester Medicine Tracker System 1.0. This vulnerability affects unknown code of the file index.ph… |
CVE-2023-5580 | Medium | 6.3 | 2023-10-14 | A vulnerability classified as critical has been found in SourceCodester Library System 1.0. This affects an unknown part of the file index.php. The manipulatio… |
CVE-2023-5579 | Low | 3.5 | 2023-10-14 | A vulnerability was found in yhz66 Sandbox 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /im/user/… |
CVE-2023-1259 | Medium | 4.4 | 2023-10-14 | The Hotjar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the hotjar_site_id in versions up to, and including, 1.0.15 due to insufficien… |
CVE-2023-5578 | Low | 3.5 | 2023-10-14 | A vulnerability was found in Portábilis i-Educar up to 2.7.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality o… |
CVE-2023-45348 | Medium | 4.3 | 2023-10-14 | Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when… |
CVE-2023-42792 | Medium | 6.5 | 2023-10-14 | Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a re… |
CVE-2023-42780 | Medium | 6.5 | 2023-10-14 | Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if th… |
CVE-2023-42663 | Medium | 6.5 | 2023-10-14 | Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about… |
CVE-2023-45856 | Critical | 9.8 | 2023-10-14 | qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI. |
CVE-2023-45855 | High | 7.5 | 2023-10-14 | qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI. |
CVE-2023-44037 | High | 7.5 | 2023-10-14 | An issue in ZPE Systems, Inc Nodegrid OS v.5.8.10 thru v.5.8.13 and v.5.10.3 thru v.5.10.5 allows a remote attacker to obtain sensitive information via the TAC… |
CVE-2023-26155 | High | 7.3 | 2023-10-14 | All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize its parameter input… |
CVE-2023-30154 | Critical | 9.8 | 2023-10-14 | Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perfo… |
CVE-2023-30148 | Medium | 6.1 | 2023-10-14 | Multiple Stored Cross Site Scripting (XSS) vulnerabilities in Opart opartmultihtmlblock before version 2.0.12 and Opart multihtmlblock* version 1.0.0, allows r… |
CVE-2023-45853 | Critical | 9.8 | 2023-10-14 | MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra… |
CVE-2023-45852 | Critical | 9.8 | 2023-10-14 | In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharact… |
CVE-2023-45674 | High | 7.7 | 2023-10-14 | Farmbot-Web-App is a web control interface for the Farmbot farm automation platform. An SQL injection vulnerability was found in FarmBot's web app that allows… |
CVE-2023-4257 | High | 7.6 | 2023-10-13 | Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. |
CVE-2023-4263 | High | 7.6 | 2023-10-13 | Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver |
CVE-2023-36559 | Medium | 4.2 | 2023-10-13 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2023-34977 | Medium | 4.6 | 2023-10-13 | A cross-site scripting (XSS) vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject… |
CVE-2023-34976 | Critical | 10.0 | 2023-10-13 | A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious co… |
CVE-2023-34975 | Medium | 6.6 | 2023-10-13 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-32976 | Medium | 6.6 | 2023-10-13 | An OS command injection vulnerability has been reported to affect Container Station. If exploited, the vulnerability could allow authenticated administrators t… |
CVE-2023-32974 | High | 7.5 | 2023-10-13 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read th… |
CVE-2023-32973 | Low | 3.8 | 2023-10-13 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-32970 | Medium | 4.9 | 2023-10-13 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authen… |
CVE-2023-5449 | Low | 3.3 | 2023-10-13 | A potential security vulnerability has been identified in certain HP Displays supporting the Theft Deterrence feature which may allow a monitor’s Theft Deterre… |
CVE-2023-5409 | Medium | 6.8 | 2023-10-13 | HP is aware of a potential security vulnerability in HP t430 and t638 Thin Client PCs. These models may be susceptible to a physical attack, allowing an untrus… |
CVE-2023-4499 | High | 7.5 | 2023-10-13 | A potential security vulnerability has been identified in the HP ThinUpdate utility (also known as HP Recovery Image and Software Download Tool) which may lead… |
CVE-2023-45276 | Medium | 5.4 | 2023-10-13 | Cross-Site Request Forgery (CSRF) vulnerability in automatededitor.Com Automated Editor plugin <= 1.3 versions. |
CVE-2023-45270 | Medium | 4.3 | 2023-10-13 | Cross-Site Request Forgery (CSRF) vulnerability in PINPOINT.WORLD Pinpoint Booking System plugin <= 2.9.9.4.0 versions. |
CVE-2023-45269 | Medium | 5.4 | 2023-10-13 | Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 2.0.25 versions. |
CVE-2023-40682 | Medium | 4.4 | 2023-10-13 | IBM App Connect Enterprise 12.0.1.0 through 12.0.8.0 contains an unspecified vulnerability that could allow a local privileged user to obtain sensitive informa… |
CVE-2023-45268 | Medium | 4.3 | 2023-10-13 | Cross-Site Request Forgery (CSRF) vulnerability in Hitsteps Hitsteps Web Analytics plugin <= 5.86 versions. |
CVE-2023-45267 | Medium | 4.3 | 2023-10-13 | Cross-Site Request Forgery (CSRF) vulnerability in Zizou1988 IRivYou plugin <= 2.2.1 versions. |
CVE-2023-41843 | High | 7.5 | 2023-10-13 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox… |
CVE-2023-41836 | Low | 3.5 | 2023-10-13 | An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 throug… |
CVE-2023-41682 | High | 8.1 | 2023-10-13 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.5… |
CVE-2023-41681 | High | 7.5 | 2023-10-13 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox… |
CVE-2023-41680 | High | 7.5 | 2023-10-13 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox… |
CVE-2023-33303 | High | 8.1 | 2023-10-13 | A insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows attacker to execute unauthorized code or commands via api request |
CVE-2023-45393 | Medium | 6.5 | 2023-10-13 | An indirect object reference (IDOR) in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to access sensitive information via a craft… |
CVE-2023-45391 | Medium | 4.8 | 2023-10-13 | A stored cross-site scripting (XSS) vulnerability in the Create A New Employee function of Granding UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated a… |
CVE-2023-45109 | Medium | 5.4 | 2023-10-13 | Cross-Site Request Forgery (CSRF) vulnerability in ZAKSTAN WhitePage plugin <= 1.1.5 versions. |
CVE-2023-5240 | High | 7.5 | 2023-10-13 | Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAM propagation scrip… |
CVE-2023-4995 | Medium | 6.4 | 2023-10-13 | The Embed Calendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'calendly' shortcode in versions up to, and including, 3.6 due to insu… |
CVE-2023-4829 | Medium | 5.4 | 2023-10-13 | Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22. |
CVE-2023-4517 | Medium | 5.4 | 2023-10-13 | Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6. |
CVE-2023-45468 | High | 7.5 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the pingWdogIp. This vulnerability allows attackers to cause a Denial of Service (DoS) v… |
CVE-2023-45467 | Critical | 9.8 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ntpServIP parameter in the Time Settings. |
CVE-2023-45466 | Critical | 9.8 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pin_host parameter in the WPS Settings. |
CVE-2023-45465 | Critical | 9.8 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS settings. |
CVE-2023-45464 | High | 7.5 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the servDomain parameter. This vulnerability allows attackers to cause a Denial of Servi… |
CVE-2023-45463 | High | 7.5 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the hostName parameter in the FUN_0040dabc function. This vulnerability allows attackers… |
CVE-2023-45162 | Critical | 9.9 | 2023-10-13 | Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Application of the relevant hotfix remediat… |
CVE-2023-45130 | High | 7.5 | 2023-10-13 | Frontier is Substrate's Ethereum compatibility layer. Prior to commit aea528198b3b226e0d20cce878551fd4c0e3d5d0, at the end of a contract execution, when opcode… |
CVE-2023-45108 | Medium | 4.3 | 2023-10-13 | Cross-Site Request Forgery (CSRF) vulnerability in Mailrelay plugin <= 2.1.1 versions. |
CVE-2023-45107 | Medium | 4.3 | 2023-10-13 | Cross-Site Request Forgery (CSRF) vulnerability in GoodBarber plugin <= 1.0.22 versions. |
CVE-2023-39960 | Medium | 5.0 | 2023-10-13 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as… |
CVE-2023-29464 | High | 8.2 | 2023-10-13 | FactoryTalk Linx, in the Rockwell Automation PanelView Plus, allows an unauthenticated threat actor to read data from memory via crafted malicious packets. Se… |
CVE-2023-43079 | High | 7.3 | 2023-10-13 | Dell OpenManage Server Administrator, versions 11.0.0.0 and prior, contains an Improper Access Control vulnerability. A local low-privileged malicious user co… |
CVE-2023-39999 | Medium | 4.3 | 2023-10-13 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through… |
CVE-2023-5573 | Medium | 6.5 | 2023-10-13 | Allocation of Resources Without Limits or Throttling in GitHub repository vriteio/vrite prior to 0.3.0. |
CVE-2023-5572 | Critical | 9.8 | 2023-10-13 | Server-Side Request Forgery (SSRF) in GitHub repository vriteio/vrite prior to 0.3.0. |
CVE-2023-5571 | High | 7.5 | 2023-10-13 | Improper Input Validation in GitHub repository vriteio/vrite prior to 0.3.0. |
CVE-2023-38000 | Medium | 6.5 | 2023-10-13 | Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from… |
CVE-2023-38251 | Medium | 5.3 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Uncontrolled Res… |
CVE-2023-38250 | High | 8.0 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutra… |
CVE-2023-38249 | High | 8.0 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutra… |