2023 CVEs (page 139)
Page 139 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-27312 | Medium | 5.4 | 2023-10-12 | SnapCenter Plugin for VMware vSphere versions 4.6 prior to 4.9 are susceptible to a vulnerability which may allow authenticated unprivileged users to modify… |
CVE-2023-43149 | High | 8.8 | 2023-10-12 | SPA-Cart 1.9.0.3 is vulnerable to Cross Site Request Forgery (CSRF) that allows a remote attacker to add an admin user with role status. |
CVE-2023-5072 | High | 7.5 | 2023-10-12 | Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite am… |
CVE-2023-45143 | Low | 3.9 | 2023-10-12 | Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects… |
CVE-2023-45142 | High | 7.5 | 2023-10-12 | OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http… |
CVE-2023-45138 | Critical | 10.0 | 2023-10-12 | Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to vers… |
CVE-2023-45133 | Critical | 9.3 | 2023-10-12 | Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to… |
CVE-2023-43147 | High | 8.8 | 2023-10-12 | PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery (CSRF) to add an admin user via the Add Users Function, aka an index.php?contr… |
CVE-2023-32634 | High | 7.8 | 2023-10-12 | An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta. An attacker can perform a… |
CVE-2023-32275 | Medium | 5.5 | 2023-10-12 | An information disclosure vulnerability exists in the CtEnumCa() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. Specially crafted network packets… |
CVE-2023-31192 | Medium | 5.3 | 2023-10-12 | An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674. A specially crafted network packet can lead to… |
CVE-2023-27516 | High | 7.3 | 2023-10-12 | An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network p… |
CVE-2023-27395 | Critical | 9.0 | 2023-10-12 | A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket() functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specia… |
CVE-2023-25774 | High | 7.5 | 2023-10-12 | A denial-of-service vulnerability exists in the vpnserver ConnectionAccept() functionality of SoftEther VPN 5.02. A set of specially crafted network connection… |
CVE-2023-23581 | High | 7.5 | 2023-10-12 | A denial-of-service vulnerability exists in the vpnserver EnSafeHttpHeaderValueStr functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted netwo… |
CVE-2023-22325 | Medium | 5.9 | 2023-10-12 | A denial of service vulnerability exists in the DCRegister DDNS_RPC_MAX_RECV_SIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A speciall… |
CVE-2023-22308 | High | 7.5 | 2023-10-12 | An integer underflow vulnerability exists in the vpnserver OvsProcessData functionality of SoftEther VPN 5.01.9674 and 5.02. A specially crafted network packet… |
CVE-2023-45106 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in Fedor Urvanov, Aram Kocharyan Urvanov Syntax Highlighter plugin <= 2.8.33 versions. |
CVE-2023-45103 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 versions. |
CVE-2023-45102 | Medium | 5.4 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Blog Manager Light plugin <= 1.20 versions. |
CVE-2023-41131 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <= 2.10 versions. |
CVE-2023-32124 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in Arul Prasad J Publish Confirm Message plugin <= 1.3.1 versions. |
CVE-2023-27315 | Medium | 6.5 | 2023-10-12 | SnapGathers versions prior to 4.9 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext domain user crede… |
CVE-2023-45068 | Medium | 5.4 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Contact Form by Supsystic plugin <= 1.7.27 versions. |
CVE-2023-45063 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in ReCorp AI Content Writing Assistant (Content Writer, GPT 3 & 4, ChatGPT, Image Generator) All in One plugin… |
CVE-2023-45060 | Medium | 5.4 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in Fla-shop.Com Interactive World Map plugin <= 3.2.0 versions. |
CVE-2023-45058 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in KaizenCoders Short URL plugin <= 1.6.8 versions. |
CVE-2023-45052 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in dan009 WP Bing Map Pro plugin < 5.0 versions. |
CVE-2023-45048 | Medium | 5.4 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in Repuso Social proof testimonials and reviews by Repuso plugin <= 5.00 versions. |
CVE-2023-45011 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in Igor Buyanov WP Power Stats plugin <= 2.2.3 versions. |
CVE-2023-44998 | Medium | 4.3 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in josecoelho, Randy Hoyt, steveclarkcouk, Vitaliy Kukin, Eric Le Bail, Tom Ransom Category Meta plugin plugin… |
CVE-2023-5046 | Critical | 9.8 | 2023-10-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Procost allows SQL Injection, Command L… |
CVE-2023-5045 | Critical | 9.8 | 2023-10-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Kayisi allows SQL Injection, Command Li… |
CVE-2023-43789 | Medium | 5.5 | 2023-10-12 | A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read con… |
CVE-2023-23737 | Critical | 9.3 | 2023-10-12 | Unauth. SQL Injection (SQLi) vulnerability in MainWP MainWP Broken Links Checker Extension plugin <= 4.0 versions. |
CVE-2023-23651 | High | 8.5 | 2023-10-12 | Auth. (subscriber+) SQL Injection (SQLi) vulnerability in MainWP Google Analytics Extension plugin <= 4.0.4 versions. |
CVE-2023-5556 | Medium | 6.1 | 2023-10-12 | Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194. |
CVE-2023-5555 | Medium | 6.1 | 2023-10-12 | Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4. |
CVE-2023-5554 | Medium | 4.8 | 2023-10-12 | Lack of TLS certificate verification in log transmission of a financial module within LINE client for iOS prior to 13.16.0. |
CVE-2023-45047 | High | 7.1 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in LeadSquared, Inc LeadSquared Suite plugin <= 0.7.4 versions. |
CVE-2023-5470 | Medium | 6.4 | 2023-10-12 | The Etsy Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etsy-shop' shortcode in versions up to, and including, 3.0.4 due to insuff… |
CVE-2023-32724 | Critical | 9.1 | 2023-10-12 | Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation. |
CVE-2023-32723 | High | 8.5 | 2023-10-12 | Request to LDAP is sent before user permissions are checked. |
CVE-2023-32722 | Critical | 9.6 | 2023-10-12 | The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open. |
CVE-2023-32721 | High | 7.6 | 2023-10-12 | A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. |
CVE-2023-5531 | Medium | 4.3 | 2023-10-12 | The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missi… |
CVE-2023-40833 | Critical | 9.8 | 2023-10-12 | An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosSetting. |
CVE-2023-29453 | Critical | 9.8 | 2023-10-12 | Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS tem… |
CVE-2023-40829 | High | 7.5 | 2023-10-12 | There is an interface unauthorized access vulnerability in the background of Tencent Enterprise Wechat Privatization 2.5.x and 2.6.930000. |
CVE-2023-42298 | Medium | 5.5 | 2023-10-12 | An issue in GPAC GPAC v.2.2.1 and before allows a local attacker to cause a denial of service via the Q_DecCoordOnUnitSphere function of file src/bifs/unquanti… |
CVE-2023-1943 | High | 8.0 | 2023-10-12 | Privilege Escalation in kOps using GCE/GCP Provider in Gossip Mode. |
CVE-2023-5487 | Medium | 6.5 | 2023-10-11 | Inappropriate implementation in Fullscreen in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2023-5486 | Medium | 4.3 | 2023-10-11 | Inappropriate implementation in Input in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium… |
CVE-2023-5485 | Medium | 4.3 | 2023-10-11 | Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass autofill restrictions via a crafted HTML p… |
CVE-2023-5484 | Medium | 6.5 | 2023-10-11 | Inappropriate implementation in Navigation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chr… |
CVE-2023-5483 | Medium | 6.5 | 2023-10-11 | Inappropriate implementation in Intents in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass content security policy via a crafted HTML… |
CVE-2023-5481 | Medium | 6.5 | 2023-10-11 | Inappropriate implementation in Downloads in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chro… |
CVE-2023-5479 | Medium | 6.5 | 2023-10-11 | Inappropriate implementation in Extensions API in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extensio… |
CVE-2023-5478 | Medium | 4.3 | 2023-10-11 | Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (… |
CVE-2023-5477 | Medium | 4.3 | 2023-10-11 | Inappropriate implementation in Installer in Google Chrome prior to 118.0.5993.70 allowed a local attacker to bypass discretionary access control via a crafted… |
CVE-2023-5476 | High | 8.8 | 2023-10-11 | Use after free in Blink History in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2023-5475 | Medium | 6.5 | 2023-10-11 | Inappropriate implementation in DevTools in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to b… |
CVE-2023-5474 | High | 8.8 | 2023-10-11 | Heap buffer overflow in PDF in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who convinced a user to engage in specific user interactions to p… |
CVE-2023-5473 | Medium | 6.3 | 2023-10-11 | Use after free in Cast in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who had compromised the renderer process to potentially exploit heap c… |
CVE-2023-5218 | High | 8.8 | 2023-10-11 | Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2023-44190 | Medium | 6.1 | 2023-10-11 | An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016 devices allows… |
CVE-2023-44189 | Medium | 6.1 | 2023-10-11 | An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10003 Series allows a network-adjacent attacker to byp… |
CVE-2023-39325 | High | 7.5 | 2023-10-11 | A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of… |
CVE-2023-45132 | Critical | 9.1 | 2023-10-11 | NAXSI is an open-source maintenance web application firewall (WAF) for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone… |
CVE-2023-44188 | Medium | 5.3 | 2023-10-11 | A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in telemetry processing of Juniper Networks Junos OS allows a network-based authenticated at… |
CVE-2023-44187 | Medium | 5.9 | 2023-10-11 | An Exposure of Sensitive Information vulnerability in the 'file copy' command of Junos OS Evolved allows a local, authenticated attacker with shell access to v… |
CVE-2023-44186 | High | 7.5 | 2023-10-11 | An Improper Handling of Exceptional Conditions vulnerability in AS PATH processing of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to sen… |
CVE-2023-3781 | High | 7.8 | 2023-10-11 | there is a possible use-after-free write due to improper locking. This could lead to local escalation of privilege with no additional execution privileges need… |
CVE-2023-5535 | High | 7.8 | 2023-10-11 | Use After Free in GitHub repository vim/vim prior to v9.0.2010. |
CVE-2023-43661 | High | 8.8 | 2023-10-11 | Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any… |
CVE-2023-41882 | Medium | 5.4 | 2023-10-11 | vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collabo… |
CVE-2023-41881 | Low | 3.7 | 2023-10-11 | vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources (such as tasks from that collaboration)… |
CVE-2023-40142 | High | 7.8 | 2023-10-11 | In TBD of TBD, there is a possible way to bypass carrier restrictions due to a logic error in the code. This could lead to local escalation of privilege with n… |
CVE-2023-40141 | High | 7.8 | 2023-10-11 | In temp_residency_name_store of thermal_metrics.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation o… |
CVE-2023-35662 | Critical | 9.8 | 2023-10-11 | there is a possible out of bounds write due to buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User i… |
CVE-2023-35661 | High | 7.5 | 2023-10-11 | In ProfSixDecomTcpSACKoption of RohcPacketCommon.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informati… |
CVE-2023-35660 | Medium | 6.7 | 2023-10-11 | In lwis_transaction_client_cleanup of lwis_transaction.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalatio… |
CVE-2023-35655 | Medium | 6.7 | 2023-10-11 | In CanConvertPadV2Op of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalati… |
CVE-2023-35654 | Medium | 6.7 | 2023-10-11 | In ctrl_roi of stmvl53l1_module.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege wi… |
CVE-2023-35653 | Medium | 4.4 | 2023-10-11 | In TBD of TBD, there is a possible way to access location information due to a permissions bypass. This could lead to local information disclosure with System… |
CVE-2023-35652 | High | 7.5 | 2023-10-11 | In ProtocolEmergencyCallListIndAdapter::Init of protocolcalladapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead… |
CVE-2023-35649 | High | 7.2 | 2023-10-11 | In several functions of Exynos modem files, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution wit… |
CVE-2023-35648 | Critical | 9.8 | 2023-10-11 | In ProtocolMiscLceIndAdapter::GetConfLevel() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead… |
CVE-2023-35647 | Critical | 9.8 | 2023-10-11 | In ProtocolEmbmsGlobalCellIdAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead… |
CVE-2023-35646 | Critical | 9.8 | 2023-10-11 | In TBD of TBD, there is a possible stack buffer overflow due to a missing bounds check. This could lead to remote code execution with no additional execution p… |
CVE-2023-28635 | Medium | 5.4 | 2023-10-11 | vantage6 is privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users may try to get access to resources they are not allow… |
CVE-2023-44962 | Medium | 5.3 | 2023-10-11 | File Upload vulnerability in Koha Library Software 23.05.04 and before allows a remote attacker to read arbitrary files via the upload-cover-image.pl component. |
CVE-2023-44961 | High | 7.5 | 2023-10-11 | SQL Injection vulnerability in Koha Library Software 23.0.5.04 and before allows a remote attacker to obtain sensitive information via the intranet/cgi bin/cat… |
CVE-2023-38817 | High | 7.8 | 2023-10-11 | An issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via a crafted command to the echo_driver.sys component. NOTE: the… |
CVE-2023-35645 | Medium | 6.4 | 2023-10-11 | In tbd of tbd, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges… |
CVE-2023-43960 | High | 8.8 | 2023-10-11 | An issue in DLINK DPH-400SE FRU 2.2.15.8 allows a remote attacker to escalate privileges via the User Modify function in the Maintenance/Access function compon… |
CVE-2023-23930 | Medium | 5.5 | 2023-10-11 | vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a default serializatio… |
CVE-2023-4936 | Medium | 5.5 | 2023-10-11 | It is possible to sideload a compromised DLL during the installation at elevated privilege. |
CVE-2023-35968 | Critical | 9.8 | 2023-10-11 | Two heap-based buffer overflow vulnerabilities exist in the gwcfg_cgi_set_manage_post_data functionality of Yifan YF325 v1.0_20221108. A specially crafted netw… |
CVE-2023-35967 | Critical | 9.8 | 2023-10-11 | Two heap-based buffer overflow vulnerabilities exist in the gwcfg_cgi_set_manage_post_data functionality of Yifan YF325 v1.0_20221108. A specially crafted netw… |