2023 CVEs (page 137)
Page 137 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-44985 | Medium | 6.5 | 2023-10-16 | Auth. (contributo+) Stored Cross-Site Scripting (XSS) vulnerability in Cytech BuddyMeet plugin <= 2.2.0 versions. |
CVE-2023-44984 | Medium | 6.5 | 2023-10-16 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Robin Wilson bbp style pack plugin <= 5.6.7 versions. |
CVE-2023-44229 | Medium | 5.9 | 2023-10-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Tiny Carousel Horizontal Slider plugin <= 8.1 versions. |
CVE-2023-4457 | Medium | 5.5 | 2023-10-16 | Grafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable… |
CVE-2023-45647 | Medium | 5.4 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in MailMunch Constant Contact Forms by MailMunch plugin <= 2.0.10 versions. |
CVE-2023-45645 | Medium | 5.4 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in InfoD74 WP Open Street Map plugin <= 1.25 versions. |
CVE-2023-45643 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Anurag Deshmukh CPT Shortcode Generator plugin <= 1.0 versions. |
CVE-2023-45642 | Medium | 5.4 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Hassan Ali Snap Pixel plugin <= 1.5.7 versions. |
CVE-2023-45641 | Medium | 5.4 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Caret Inc. Caret Country Access Limit plugin <= 1.0.2 versions. |
CVE-2023-45639 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Codex-m Sort SearchResult By Title plugin <= 10.0 versions. |
CVE-2023-3991 | Critical | 10.0 | 2023-10-16 | An OS command injection vulnerability exists in the httpd iperfrun.cgi functionality of FreshTomato 2023.3. A specially crafted HTTP request can lead to arbitr… |
CVE-2023-5595 | Medium | 5.5 | 2023-10-16 | Denial of Service in GitHub repository gpac/gpac prior to 2.3.0-DEV. |
CVE-2023-5422 | High | 8.7 | 2023-10-16 | The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSL_get_verify… |
CVE-2023-5421 | Low | 3.5 | 2023-10-16 | An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScrip… |
CVE-2023-4834 | Medium | 4.3 | 2023-10-16 | In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validatio… |
CVE-2023-4827 | High | 8.8 | 2023-10-16 | The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attackers to make highly… |
CVE-2023-4822 | Medium | 6.7 | 2023-10-16 | Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user… |
CVE-2023-4620 | Medium | 6.1 | 2023-10-16 | The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stor… |
CVE-2023-45757 | Medium | 6.1 | 2023-10-16 | Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page. An attacker that can send http req… |
CVE-2023-45656 | Medium | 5.4 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Kevin Weber Lazy Load for Videos plugin <= 2.18.2 versions. |
CVE-2023-45655 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in PixelGrade PixFields plugin <= 0.7.0 versions. |
CVE-2023-45654 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions. |
CVE-2023-45653 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Galaxy Weblinks Video Playlist For YouTube plugin <= 6.0 versions. |
CVE-2023-45651 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi WP Attachments allows Cross Site Request Forgery.This issue affects WP Attachments: from n/a th… |
CVE-2023-45650 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Fla-shop.Com HTML5 Maps plugin <= 1.7.1.4 versions. |
CVE-2023-45638 | Medium | 6.5 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in euPago Eupago Gateway For Woocommerce plugin <= 3.1.9 versions. |
CVE-2023-45629 | Medium | 5.4 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions. |
CVE-2023-45606 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Lasso Simple URLs plugin <= 120 versions. |
CVE-2023-45605 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Christopher Finke Feed Statistics plugin <= 4.1 versions. |
CVE-2023-45274 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in SendPulse SendPulse Free Web Push plugin <= 1.3.1 versions. |
CVE-2023-45273 | Medium | 4.3 | 2023-10-16 | Cross-Site Request Forgery (CSRF) vulnerability in Matt McKenny Stout Google Calendar plugin <= 1.2.3 versions. |
CVE-2023-43668 | Critical | 9.8 | 2023-10-16 | Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive pa… |
CVE-2023-43667 | High | 7.5 | 2023-10-16 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue affects Apache InL… |
CVE-2023-43666 | Medium | 6.5 | 2023-10-16 | Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, General user can vi… |
CVE-2023-3392 | High | 7.2 | 2023-10-16 | The Read More & Accordion WordPress plugin before 3.2.7 unserializes user input provided via the settings, which could allow high-privilege users such as admin… |
CVE-2023-38059 | Medium | 5.3 | 2023-10-16 | The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the… |
CVE-2023-45158 | Critical | 9.8 | 2023-10-16 | An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default… |
CVE-2023-45580 | Critical | 9.8 | 2023-10-16 | Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-72… |
CVE-2023-45579 | Critical | 9.8 | 2023-10-16 | Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-72… |
CVE-2023-45578 | Critical | 9.8 | 2023-10-16 | Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-72… |
CVE-2023-45577 | Critical | 9.8 | 2023-10-16 | Stack Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-720… |
CVE-2023-45576 | Critical | 9.8 | 2023-10-16 | Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-72… |
CVE-2023-21415 | Medium | 6.5 | 2023-10-16 | Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for fi… |
CVE-2023-21414 | High | 7.1 | 2023-10-16 | NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. The protection for device tampering (commonly known as S… |
CVE-2023-21413 | Critical | 9.1 | 2023-10-16 | GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on the Axis device. Th… |
CVE-2023-45575 | Critical | 9.8 | 2023-10-16 | Stack Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-720… |
CVE-2023-45574 | Critical | 9.8 | 2023-10-16 | Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-72… |
CVE-2023-45573 | Critical | 9.8 | 2023-10-16 | Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-72… |
CVE-2023-45572 | Critical | 9.8 | 2023-10-16 | Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-72… |
CVE-2023-44809 | Critical | 9.8 | 2023-10-16 | D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions. |
CVE-2023-44808 | Critical | 9.8 | 2023-10-16 | D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_4507CC function. |
CVE-2023-36955 | Critical | 9.8 | 2023-10-16 | TOTOLINK CP300+ <=V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule. |
CVE-2023-36954 | Critical | 9.8 | 2023-10-16 | TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection. |
CVE-2023-36953 | Critical | 9.8 | 2023-10-16 | TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection. |
CVE-2023-36950 | Critical | 9.8 | 2023-10-16 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the http_host parameter in the… |
CVE-2023-36952 | Critical | 9.8 | 2023-10-16 | TOTOLINK CP300+ V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the pingIp parameter in the function setDiagnosisCfg. |
CVE-2023-36947 | Critical | 9.8 | 2023-10-16 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File parameter in the func… |
CVE-2023-36340 | Critical | 9.8 | 2023-10-16 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth. |
CVE-2023-45898 | High | 7.8 | 2023-10-16 | The Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extents_status.c, related to ext4_es_insert_extent. |
CVE-2023-40791 | Medium | 6.3 | 2023-10-16 | extract_user_to_sg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails to unpin pages in a certain situation, as demonstrated by a WARNING for try_gra… |
CVE-2023-38280 | High | 8.4 | 2023-10-16 | IBM HMC (Hardware Management Console) 10.1.1010.0 and 10.2.1030.0 could allow a local user to escalate their privileges to root access on a restricted shell… |
CVE-2023-5591 | Medium | 6.5 | 2023-10-16 | SQL Injection in GitHub repository librenms/librenms prior to 23.10.0. |
CVE-2023-40377 | Medium | 4.9 | 2023-10-16 | Backup, Recovery, and Media Services (BRMS) for IBM i 7.2, 7.3, and 7.4 contains a local privilege escalation vulnerability. A malicious actor with command li… |
CVE-2023-33836 | Medium | 5.3 | 2023-10-16 | IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2023-35018 | Low | 3.3 | 2023-10-16 | IBM Security Verify Governance 10.0 could allow a privileged use to upload arbitrary files due to improper file validation. IBM X-Force ID: 259382. |
CVE-2023-35013 | Low | 2.3 | 2023-10-16 | IBM Security Verify Governance 10.0, Identity Manager could allow a local privileged user to obtain sensitive information from source code. IBM X-Force ID: 2… |
CVE-2023-5590 | High | 7.5 | 2023-10-15 | NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.0. |
CVE-2023-5589 | High | 7.3 | 2023-10-15 | A vulnerability was found in SourceCodester Judging Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2023-5588 | Low | 2.6 | 2023-10-15 | A vulnerability was found in kphrx pleroma. It has been classified as problematic. This affects the function Pleroma.Emoji.Pack of the file lib/pleroma/emoji/p… |
CVE-2023-5587 | Medium | 6.3 | 2023-10-15 | A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0 and classified as critical. Affected by this issue is some… |
CVE-2023-38312 | High | 7.5 | 2023-10-15 | A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client (with remote control access to a game server) to read arbitrary files from the… |
CVE-2023-40378 | Medium | 4.9 | 2023-10-15 | IBM Directory Server for IBM i contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system ca… |
CVE-2023-5586 | High | 7.8 | 2023-10-15 | NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3.0-DEV. |
CVE-2023-45871 | High | 7.5 | 2023-10-15 | An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for… |
CVE-2023-5585 | Low | 2.4 | 2023-10-15 | A vulnerability was found in SourceCodester Online Motorcycle Rental System 1.0. It has been declared as problematic. This vulnerability affects unknown code o… |
CVE-2023-45863 | Medium | 6.4 | 2023-10-14 | An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_ko… |
CVE-2023-45862 | Medium | 5.5 | 2023-10-14 | An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially exte… |
CVE-2023-40367 | Medium | 5.4 | 2023-10-14 | IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the… |
CVE-2023-30994 | Medium | 5.4 | 2023-10-14 | IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID… |
CVE-2023-45176 | Medium | 6.2 | 2023-10-14 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.10.0 and IBM Integration Bus 10.1 through 10.1.0.1 are vulnerable to a denial of s… |
CVE-2023-35024 | Medium | 4.6 | 2023-10-14 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vul… |
CVE-2023-5582 | Low | 3.5 | 2023-10-14 | A vulnerability, which was classified as problematic, has been found in ZZZCMS 2.2.0. This issue affects some unknown processing of the component Personal Prof… |
CVE-2023-5581 | Low | 3.5 | 2023-10-14 | A vulnerability classified as problematic was found in SourceCodester Medicine Tracker System 1.0. This vulnerability affects unknown code of the file index.ph… |
CVE-2023-5580 | Medium | 6.3 | 2023-10-14 | A vulnerability classified as critical has been found in SourceCodester Library System 1.0. This affects an unknown part of the file index.php. The manipulatio… |
CVE-2023-5579 | Low | 3.5 | 2023-10-14 | A vulnerability was found in yhz66 Sandbox 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /im/user/… |
CVE-2023-1259 | Medium | 4.4 | 2023-10-14 | The Hotjar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the hotjar_site_id in versions up to, and including, 1.0.15 due to insufficien… |
CVE-2023-5578 | Low | 3.5 | 2023-10-14 | A vulnerability was detected in Portábilis i-Educar up to 2.7.5. Affected is an unknown function of the file \intranet\agenda_imprimir.php of the component HTT… |
CVE-2023-45348 | Medium | 4.3 | 2023-10-14 | Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when… |
CVE-2023-42792 | Medium | 6.5 | 2023-10-14 | Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a re… |
CVE-2023-42780 | Medium | 6.5 | 2023-10-14 | Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if th… |
CVE-2023-42663 | Medium | 6.5 | 2023-10-14 | Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about… |
CVE-2023-45856 | Critical | 9.8 | 2023-10-14 | qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI. |
CVE-2023-45855 | High | 7.5 | 2023-10-14 | qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI. |
CVE-2023-44037 | High | 7.5 | 2023-10-14 | An issue in ZPE Systems, Inc Nodegrid OS v.5.8.10 thru v.5.8.13 and v.5.10.3 thru v.5.10.5 allows a remote attacker to obtain sensitive information via the TAC… |
CVE-2023-26155 | High | 7.3 | 2023-10-14 | All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize its parameter input… |
CVE-2023-30154 | Critical | 9.8 | 2023-10-14 | Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perfo… |
CVE-2023-30148 | Medium | 6.1 | 2023-10-14 | Multiple Stored Cross Site Scripting (XSS) vulnerabilities in Opart opartmultihtmlblock before version 2.0.12 and Opart multihtmlblock* version 1.0.0, allows r… |
CVE-2023-45853 | Critical | 9.8 | 2023-10-14 | MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra… |
CVE-2023-45852 | Critical | 9.8 | 2023-10-14 | In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharact… |
CVE-2023-45674 | High | 7.7 | 2023-10-14 | Farmbot-Web-App is a web control interface for the Farmbot farm automation platform. An SQL injection vulnerability was found in FarmBot's web app that allows… |