2023 CVEs (page 138)
Page 138 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38221 | High | 8.0 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutra… |
CVE-2023-38220 | High | 7.5 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Author… |
CVE-2023-38219 | High | 8.7 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Sit… |
CVE-2023-38218 | High | 8.8 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Autho… |
CVE-2023-26367 | Medium | 4.9 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Input… |
CVE-2023-26366 | Medium | 6.8 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Requ… |
CVE-2023-5557 | High | 7.5 | 2023-10-13 | A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-… |
CVE-2023-4562 | Critical | 9.1 | 2023-10-13 | Improper Authentication vulnerability in Mitsubishi Electric Corporation MELSEC-F Series main modules allows a remote unauthenticated attacker to obtain sequen… |
CVE-2023-42752 | Medium | 5.5 | 2023-10-13 | An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating `skb_shared_info` in the userspace, which is exploitable in s… |
CVE-2023-5564 | Medium | 4.8 | 2023-10-13 | Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1. |
CVE-2023-5563 | High | 7.1 | 2023-10-13 | The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This result… |
CVE-2023-44204 | Medium | 6.5 | 2023-10-13 | An Improper Validation of Syntactic Correctness of Input vulnerability in Routing Protocol Daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved allows… |
CVE-2023-44203 | Medium | 6.5 | 2023-10-13 | An Improper Check or Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on QFX5000 Series, EX… |
CVE-2023-44201 | Medium | 5.0 | 2023-10-13 | An Incorrect Permission Assignment for Critical Resource vulnerability in a specific file of Juniper Networks Junos OS and Junos OS Evolved allows a local aut… |
CVE-2023-44199 | High | 7.5 | 2023-10-13 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows a… |
CVE-2023-44198 | Medium | 5.8 | 2023-10-13 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the SIP ALG of Juniper Networks Junos OS on SRX Series and MX Series allows an unauth… |
CVE-2023-44197 | High | 7.5 | 2023-10-13 | An Out-of-Bounds Write vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network… |
CVE-2023-44196 | Medium | 6.5 | 2023-10-13 | An Improper Check for Unusual or Exceptional Conditions in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS Evolved on PTX10003 Series allows a… |
CVE-2023-44195 | Medium | 5.4 | 2023-10-13 | An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the NetworkStack agent daemon (nsagentd) of Juniper Networks Junos OS… |
CVE-2023-44194 | High | 8.4 | 2023-10-13 | An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS allows an unauthenticated attacker with local access to the device to create a bac… |
CVE-2023-44193 | Medium | 5.5 | 2023-10-13 | An Improper Release of Memory Before Removing Last Reference vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows a local, low… |
CVE-2023-44192 | High | 7.5 | 2023-10-13 | An Improper Input Validation vulnerability in the Packet Forwarding Engine of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to c… |
CVE-2023-44191 | High | 7.5 | 2023-10-13 | An Allocation of Resources Without Limits or Throttling vulnerability in Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause… |
CVE-2023-44185 | High | 7.5 | 2023-10-13 | An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks allows an attacker to cause a Denial of Service (DoS )to t… |
CVE-2023-44184 | Medium | 6.5 | 2023-10-13 | An Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the management daemon (mgd) process of Juniper Networks Junos OS a… |
CVE-2023-44183 | Medium | 6.5 | 2023-10-13 | An Improper Input Validation vulnerability in the VxLAN packet forwarding engine (PFE) of Juniper Networks Junos OS on QFX5000 Series, EX4600 Series devices a… |
CVE-2023-44182 | High | 7.3 | 2023-10-13 | An Unchecked Return Value vulnerability in the user interfaces to the Juniper Networks Junos OS and Junos OS Evolved, the CLI, the XML API, the XML Management… |
CVE-2023-44181 | High | 7.5 | 2023-10-13 | An Improperly Implemented Security Check for Standard vulnerability in storm control of Juniper Networks Junos OS QFX5k devices allows packets to be punted to… |
CVE-2023-44178 | Medium | 5.5 | 2023-10-13 | A Stack-based Buffer Overflow vulnerability in the CLI command of Juniper Networks Junos OS allows a low privileged attacker to execute a specific CLI command… |
CVE-2023-44177 | Medium | 5.5 | 2023-10-13 | A Stack-based Buffer Overflow vulnerability in the CLI command of Juniper Networks Junos and Junos EVO allows a low privileged attacker to execute a specific… |
CVE-2023-44176 | Medium | 5.5 | 2023-10-13 | A Stack-based Buffer Overflow vulnerability in the CLI command of Juniper Networks Junos OS allows a low privileged attacker to execute a specific CLI command… |
CVE-2023-44175 | Medium | 6.5 | 2023-10-12 | A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows to send specific genuine PIM… |
CVE-2023-41263 | Low | 3.7 | 2023-10-12 | An issue was discovered in Plixer Scrutinizer before 19.3.1. It exposes debug logs to unauthenticated users at the /debug/ URL path. With knowledge of valid IP… |
CVE-2023-41262 | Critical | 9.8 | 2023-10-12 | An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV is vulnerable to SQL inje… |
CVE-2023-41261 | Medium | 5.3 | 2023-10-12 | An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV does not require authenti… |
CVE-2023-36843 | High | 7.5 | 2023-10-12 | An Improper Handling of Inconsistent Special Elements vulnerability in the Junos Services Framework (jsf) module of Juniper Networks Junos OS allows an unauth… |
CVE-2023-36841 | High | 7.5 | 2023-10-12 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows a… |
CVE-2023-36839 | Medium | 6.5 | 2023-10-12 | An Improper Validation of Specified Quantity in Input vulnerability in the Layer-2 control protocols daemon (l2cpd) of Juniper Networks Junos OS and Junos OS… |
CVE-2023-22392 | Medium | 6.5 | 2023-10-12 | A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent, unau… |
CVE-2023-27316 | High | 8.8 | 2023-10-12 | SnapCenter versions 4.8 through 4.9 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin user on a r… |
CVE-2023-45511 | Medium | 5.5 | 2023-10-12 | A memory leak in tsMuxer version git-2539d07 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file. |
CVE-2023-45510 | High | 7.5 | 2023-10-12 | tsMuxer version git-2539d07 was discovered to contain an alloc-dealloc-mismatch (operator new [] vs operator delete) error. |
CVE-2023-5562 | Medium | 6.1 | 2023-10-12 | An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an… |
CVE-2023-23632 | High | 7.8 | 2023-10-12 | BeyondTrust Privileged Remote Access (PRA) versions 22.2.x to 22.4.x are vulnerable to a local authentication bypass. Attackers can exploit a flawed secret ver… |
CVE-2023-43148 | High | 8.1 | 2023-10-12 | SPA-Cart 1.9.0.3 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to delete all accounts. |
CVE-2023-27314 | High | 7.5 | 2023-10-12 | ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow a remote unauthenti… |
CVE-2023-27313 | High | 8.3 | 2023-10-12 | SnapCenter versions 3.x and 4.x prior to 4.9 are susceptible to a vulnerability which may allow an authenticated unprivileged user to gain access as an admin… |
CVE-2023-27312 | Medium | 5.4 | 2023-10-12 | SnapCenter Plugin for VMware vSphere versions 4.6 prior to 4.9 are susceptible to a vulnerability which may allow authenticated unprivileged users to modify… |
CVE-2023-43149 | High | 8.8 | 2023-10-12 | SPA-Cart 1.9.0.3 is vulnerable to Cross Site Request Forgery (CSRF) that allows a remote attacker to add an admin user with role status. |
CVE-2023-5072 | High | 7.5 | 2023-10-12 | Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite am… |
CVE-2023-45143 | Low | 3.9 | 2023-10-12 | Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects… |
CVE-2023-45142 | High | 7.5 | 2023-10-12 | OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http… |
CVE-2023-45138 | Critical | 10.0 | 2023-10-12 | Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to vers… |
CVE-2023-45133 | Critical | 9.3 | 2023-10-12 | Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to… |
CVE-2023-43147 | High | 8.8 | 2023-10-12 | PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery (CSRF) to add an admin user via the Add Users Function, aka an index.php?contr… |
CVE-2023-32634 | High | 7.8 | 2023-10-12 | An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta. An attacker can perform a… |
CVE-2023-32275 | Medium | 5.5 | 2023-10-12 | An information disclosure vulnerability exists in the CtEnumCa() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. Specially crafted network packets… |
CVE-2023-31192 | Medium | 5.3 | 2023-10-12 | An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674. A specially crafted network packet can lead to… |
CVE-2023-27516 | High | 7.3 | 2023-10-12 | An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network p… |
CVE-2023-27395 | Critical | 9.0 | 2023-10-12 | A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket() functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specia… |
CVE-2023-25774 | High | 7.5 | 2023-10-12 | A denial-of-service vulnerability exists in the vpnserver ConnectionAccept() functionality of SoftEther VPN 5.02. A set of specially crafted network connection… |
CVE-2023-23581 | High | 7.5 | 2023-10-12 | A denial-of-service vulnerability exists in the vpnserver EnSafeHttpHeaderValueStr functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted netwo… |
CVE-2023-22325 | Medium | 5.9 | 2023-10-12 | A denial of service vulnerability exists in the DCRegister DDNS_RPC_MAX_RECV_SIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A speciall… |
CVE-2023-22308 | High | 7.5 | 2023-10-12 | An integer underflow vulnerability exists in the vpnserver OvsProcessData functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted network packet… |
CVE-2023-45106 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in Fedor Urvanov, Aram Kocharyan Urvanov Syntax Highlighter plugin <= 2.8.33 versions. |
CVE-2023-45103 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 versions. |
CVE-2023-45102 | Medium | 5.4 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Blog Manager Light plugin <= 1.20 versions. |
CVE-2023-41131 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <= 2.10 versions. |
CVE-2023-32124 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in Arul Prasad J Publish Confirm Message plugin <= 1.3.1 versions. |
CVE-2023-27315 | Medium | 6.5 | 2023-10-12 | SnapGathers versions prior to 4.9 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext domain user crede… |
CVE-2023-45068 | Medium | 5.4 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Contact Form by Supsystic plugin <= 1.7.27 versions. |
CVE-2023-45063 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in ReCorp AI Content Writing Assistant (Content Writer, GPT 3 & 4, ChatGPT, Image Generator) All in One plugin… |
CVE-2023-45060 | Medium | 5.4 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in Fla-shop.Com Interactive World Map plugin <= 3.2.0 versions. |
CVE-2023-45058 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in KaizenCoders Short URL plugin <= 1.6.8 versions. |
CVE-2023-45052 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in dan009 WP Bing Map Pro plugin < 5.0 versions. |
CVE-2023-45048 | Medium | 5.4 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in Repuso Social proof testimonials and reviews by Repuso plugin <= 5.00 versions. |
CVE-2023-45011 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in Igor Buyanov WP Power Stats plugin <= 2.2.3 versions. |
CVE-2023-44998 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in josecoelho, Randy Hoyt, steveclarkcouk, Vitaliy Kukin, Eric Le Bail, Tom Ransom Category Meta plugin plugin… |
CVE-2023-5046 | Critical | 9.8 | 2023-10-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Procost allows SQL Injection, Command L… |
CVE-2023-5045 | Critical | 9.8 | 2023-10-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Kayisi allows SQL Injection, Command Li… |
CVE-2023-43789 | Medium | 5.5 | 2023-10-12 | A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read con… |
CVE-2023-23737 | Critical | 9.3 | 2023-10-12 | Unauth. SQL Injection (SQLi) vulnerability in MainWP MainWP Broken Links Checker Extension plugin <= 4.0 versions. |
CVE-2023-23651 | High | 8.5 | 2023-10-12 | Auth. (subscriber+) SQL Injection (SQLi) vulnerability in MainWP Google Analytics Extension plugin <= 4.0.4 versions. |
CVE-2023-5556 | Medium | 6.1 | 2023-10-12 | Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194. |
CVE-2023-5555 | Medium | 6.1 | 2023-10-12 | Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4. |
CVE-2023-5554 | Medium | 4.8 | 2023-10-12 | Lack of TLS certificate verification in log transmission of a financial module within LINE client for iOS prior to 13.16.0. |
CVE-2023-45047 | High | 7.1 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in LeadSquared, Inc LeadSquared Suite plugin <= 0.7.4 versions. |
CVE-2023-5470 | Medium | 6.4 | 2023-10-12 | The Etsy Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etsy-shop' shortcode in versions up to, and including, 3.0.4 due to insuff… |
CVE-2023-32724 | Critical | 9.1 | 2023-10-12 | Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation. |
CVE-2023-32723 | High | 8.5 | 2023-10-12 | Request to LDAP is sent before user permissions are checked. |
CVE-2023-32722 | Critical | 9.6 | 2023-10-12 | The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open. |
CVE-2023-32721 | High | 7.6 | 2023-10-12 | A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. |
CVE-2023-5531 | Medium | 4.3 | 2023-10-12 | The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missi… |
CVE-2023-40833 | Critical | 9.8 | 2023-10-12 | An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosSetting. |
CVE-2023-29453 | Critical | 9.8 | 2023-10-12 | Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS tem… |
CVE-2023-40829 | High | 7.5 | 2023-10-12 | There is an interface unauthorized access vulnerability in the background of Tencent Enterprise Wechat Privatization 2.5.x and 2.6.930000. |
CVE-2023-42298 | Medium | 5.5 | 2023-10-12 | An issue in GPAC GPAC v.2.2.1 and before allows a local attacker to cause a denial of service via the Q_DecCoordOnUnitSphere function of file src/bifs/unquanti… |
CVE-2023-1943 | High | 8.0 | 2023-10-12 | Privilege Escalation in kOps using GCE/GCP Provider in Gossip Mode. |
CVE-2023-5487 | Medium | 6.5 | 2023-10-11 | Inappropriate implementation in Fullscreen in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2023-5486 | Medium | 4.3 | 2023-10-11 | Inappropriate implementation in Input in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium… |