2023 CVEs (page 142)
Page 142 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-44087 | High | 7.8 | 2023-10-10 | A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0… |
CVE-2023-44086 | High | 7.8 | 2023-10-10 | A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0… |
CVE-2023-44085 | High | 7.8 | 2023-10-10 | A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0… |
CVE-2023-44084 | High | 7.8 | 2023-10-10 | A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0… |
CVE-2023-44083 | High | 7.8 | 2023-10-10 | A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0… |
CVE-2023-44082 | High | 7.8 | 2023-10-10 | A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0… |
CVE-2023-44081 | High | 7.8 | 2023-10-10 | A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0… |
CVE-2023-43625 | Critical | 9.8 | 2023-10-10 | A vulnerability has been identified in Simcenter Amesim (All versions < V2021.1). The affected application contains a SOAP endpoint that could allow an unauthe… |
CVE-2023-43623 | Medium | 5.3 | 2023-10-10 | A vulnerability has been identified in Mendix Forgot Password (Mendix 10 compatible) (All versions < V5.4.0), Mendix Forgot Password (Mendix 7 compatible) (All… |
CVE-2023-42796 | High | 7.5 | 2023-10-10 | A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11), CP-8050 MASTER MODULE (All versions < CPCI85 V05.11). The web serv… |
CVE-2023-38640 | Medium | 6.6 | 2023-10-10 | A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The affected application is installed with specific files and folders wit… |
CVE-2023-37195 | Medium | 4.4 | 2023-10-10 | A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATIC CP 1626 (All ver… |
CVE-2023-37194 | Medium | 6.7 | 2023-10-10 | A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATIC CP 1626 (All ver… |
CVE-2023-36380 | Critical | 9.8 | 2023-10-10 | A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11 (only with activated debug support)), CP-8050 MASTER MODULE (All ver… |
CVE-2023-35796 | High | 8.3 | 2023-10-10 | A vulnerability has been identified in SINEMA Server V14 (All versions). The affected application improperly sanitizes certain SNMP configuration data retrieve… |
CVE-2023-30900 | High | 7.8 | 2023-10-10 | A vulnerability has been identified in Xpedition Layout Browser (All versions < VX.2.14). Affected application contains a stack overflow vulnerability when par… |
CVE-2023-5498 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) in GitHub repository chiefonboarding/chiefonboarding prior to v2.0.47. |
CVE-2023-4837 | High | 8.8 | 2023-10-10 | SmodBIP is vulnerable to Cross-Site Request Forgery, that could be used to induce logged in users to perform unintended actions, including creation of addition… |
CVE-2023-44261 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Dinesh Karki Block Plugin Update plugin <= 3.3 versions. |
CVE-2023-44259 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Mediavine Mediavine Control Panel plugin <= 2.10.2 versions. |
CVE-2023-44257 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Hometory Mang Board WP plugin <= 1.7.6 versions. |
CVE-2023-41876 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Hardik Kalathiya WP Gallery Metabox plugin <= 1.0.0 versions. |
CVE-2023-41858 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Ashok Rane Order Delivery Date for WP e-Commerce plugin <= 1.2 versions. |
CVE-2023-41854 | Medium | 5.4 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Softaculous Ltd. WpCentral plugin <= 1.5.7 versions. |
CVE-2023-41853 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in WP iCal Availability plugin <= 1.0.3 versions. |
CVE-2023-41852 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailMunch – Grow your Email List plugin <= 3.1.2 versions. |
CVE-2023-41851 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Dotsquares WP Custom Post Template <= 1.0 versions. |
CVE-2023-41850 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Morris Bryant, Ruben Sargsyan Outbound Link Manager plugin <= 1.2 versions. |
CVE-2023-41730 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in SendPress Newsletters plugin <= 1.22.3.31 versions. |
CVE-2023-41697 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Nikunj Soni Easy WP Cleaner plugin <= 1.9 versions. |
CVE-2023-41694 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Realbig Team Realbig For WordPress plugin <= 1.0.3 versions. |
CVE-2023-41684 | Medium | 4.3 | 2023-10-10 | Cross-Site Request Forgery (CSRF) vulnerability in Felix Welberg SIS Handball plugin <= 1.0.45 versions. |
CVE-2023-5468 | Medium | 6.4 | 2023-10-10 | The Slick Contact Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcscf-link' shortcode in versions up to, and including, 1.3.7 du… |
CVE-2023-5467 | Medium | 6.4 | 2023-10-10 | The GEO my WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.0 due to insufficient… |
CVE-2023-45208 | High | 8.8 | 2023-10-10 | A command injection in the parsing_xml_stasurvey function inside libcgifunc.so of the D-Link DAP-X1860 repeater 1.00 through 1.01b05-01 allows attackers (withi… |
CVE-2023-44959 | High | 8.8 | 2023-10-10 | An issue found in D-Link DSL-3782 v.1.03 and before allows remote authenticated users to execute arbitrary code as root via the Router IP Address fields of the… |
CVE-2023-44827 | High | 8.8 | 2023-10-10 | An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code v… |
CVE-2023-44826 | Medium | 5.4 | 2023-10-10 | Cross Site Scripting vulnerability in ZenTaoPMS v.18.6 allows a local attacker to obtain sensitive information via a crafted script. |
CVE-2023-42189 | High | 7.5 | 2023-10-10 | Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42… |
CVE-2023-42477 | Medium | 6.5 | 2023-10-10 | SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limi… |
CVE-2023-42475 | Medium | 4.3 | 2023-10-10 | The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impa… |
CVE-2023-42474 | Medium | 6.8 | 2023-10-10 | SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link t… |
CVE-2023-42473 | Medium | 5.4 | 2023-10-10 | S/4HANA Manage (Withholding Tax Items) - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of pri… |
CVE-2023-41365 | Medium | 4.3 | 2023-10-10 | SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, whi… |
CVE-2023-40310 | Medium | 6.5 | 2023-10-10 | SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external ent… |
CVE-2023-5471 | Medium | 6.3 | 2023-10-10 | A vulnerability, which was classified as critical, was found in codeprojects Farmacia 1.0. Affected is an unknown function of the file index.php. The manipulat… |
CVE-2023-44848 | High | 8.1 | 2023-10-10 | An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_template.php component. |
CVE-2023-44847 | High | 7.2 | 2023-10-10 | An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ Weixin.php component. |
CVE-2023-44846 | High | 8.8 | 2023-10-10 | An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ notify.php component. |
CVE-2023-5463 | High | 7.8 | 2023-10-09 | A vulnerability was found in XINJE XDPPro up to 3.7.17a. It has been rated as critical. Affected by this issue is some unknown functionality in the library cfg… |
CVE-2023-5462 | Medium | 6.5 | 2023-10-09 | A vulnerability was found in XINJE XD5E-30R-E 3.5.3b. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the compo… |
CVE-2023-43899 | Critical | 9.8 | 2023-10-09 | hansun CMS v1.0 was discovered to contain a SQL injection vulnerability via the component /ajax/ajax_login.ashx. |
CVE-2023-43641 | High | 8.8 | 2023-10-09 | libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GN… |
CVE-2023-44813 | Medium | 6.1 | 2023-10-09 | Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of… |
CVE-2023-44812 | Medium | 6.1 | 2023-10-09 | Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the admin_redirect_ur… |
CVE-2023-43271 | Critical | 9.1 | 2023-10-09 | Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other p… |
CVE-2023-5461 | Low | 3.7 | 2023-10-09 | A vulnerability was found in Delta Electronics WPLSoft 2.51. It has been classified as problematic. Affected is an unknown function of the component Modbus Han… |
CVE-2023-44821 | Medium | 5.5 | 2023-10-09 | Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE… |
CVE-2023-44811 | High | 8.8 | 2023-10-09 | Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via th… |
CVE-2023-44467 | Critical | 9.8 | 2023-10-09 | langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code… |
CVE-2023-44392 | High | 8.2 | 2023-10-09 | Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is… |
CVE-2023-5460 | Low | 3.5 | 2023-10-09 | A vulnerability was found in Delta Electronics WPLSoft up to 2.51 and classified as problematic. This issue affects some unknown processing of the component Mo… |
CVE-2023-5459 | Medium | 6.5 | 2023-10-09 | A vulnerability has been found in Delta Electronics DVP32ES2 PLC 1.48 and classified as critical. This vulnerability affects unknown code of the component Pass… |
CVE-2023-41672 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Rémi Leclercq Hide admin notices – Admin Notification Center plugin <= 2.3.2 versions. |
CVE-2023-41670 | Medium | 5.4 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Palasthotel (in person: Edward Bock) Use Memcached plugin <= 1.0.4 versions. |
CVE-2023-41669 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Live News plugin <= 1.06 versions. |
CVE-2023-41668 | Medium | 5.4 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <= 1.1.2 versions. |
CVE-2023-41667 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Ulf Benjaminsson WP-dTree plugin <= 4.4.5 versions. |
CVE-2023-39194 | Low | 3.2 | 2023-10-09 | A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past th… |
CVE-2023-39193 | Medium | 6.1 | 2023-10-09 | A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (… |
CVE-2023-39192 | Medium | 6.7 | 2023-10-09 | A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a loca… |
CVE-2023-39189 | Medium | 5.1 | 2023-10-09 | A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. Th… |
CVE-2023-42455 | High | 8.8 | 2023-10-09 | Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator k… |
CVE-2023-5365 | Critical | 9.8 | 2023-10-09 | HP LIFE Android Mobile application is potentially vulnerable to escalation of privilege and/or information disclosure. |
CVE-2023-44400 | Medium | 6.7 | 2023-10-09 | Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is cau… |
CVE-2023-41047 | Medium | 6.2 | 2023-10-09 | OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious admins to configure… |
CVE-2023-30910 | Medium | 5.4 | 2023-10-09 | HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests. |
CVE-2023-44393 | Critical | 9.3 | 2023-10-09 | Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?pa… |
CVE-2023-44378 | High | 7.1 | 2023-10-09 | gnark is a zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.9.0, for some in-circuit values, it is possible to construct tw… |
CVE-2023-43643 | Medium | 6.1 | 2023-10-09 | AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mut… |
CVE-2023-41660 | Medium | 6.5 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in WPSynchro WP Synchro plugin <= 1.9.1 versions. |
CVE-2023-36820 | Medium | 4.8 | 2023-10-09 | Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1… |
CVE-2023-25822 | Medium | 6.3 | 2023-10-09 | ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the `com.epam.reportportal:service-api` module, corresponding to ReportPorta… |
CVE-2023-5103 | Medium | 4.3 | 2023-10-09 | Improper Restriction of Rendered UI Layers or Frames in RDT400 in SICK APU allows an unprivileged remote attacker to potentially reveal sensitive information v… |
CVE-2023-5102 | Medium | 5.3 | 2023-10-09 | Insufficient Control Flow Management in RDT400 in SICK APU allows an unprivileged remote attacker to potentially enable hidden functionality via HTTP requests… |
CVE-2023-5101 | Medium | 5.3 | 2023-10-09 | Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files from the server via… |
CVE-2023-5100 | Medium | 5.9 | 2023-10-09 | Cleartext Transmission of Sensitive Information in RDT400 in SICK APU allows an unprivileged remote attacker to retrieve potentially sensitive information via… |
CVE-2023-43698 | High | 7.1 | 2023-10-09 | Improper Neutralization of Input During Web Page Generation (’Cross-site Scripting’) in RDT400 in SICK APU allows an unprivileged remote attacker to run arbit… |
CVE-2023-43697 | Medium | 6.5 | 2023-10-09 | Modification of Assumed-Immutable Data (MAID) in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load necessary strings v… |
CVE-2023-45248 | High | 7.3 | 2023-10-09 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 36… |
CVE-2023-45247 | High | 7.1 | 2023-10-09 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux… |
CVE-2023-43700 | High | 7.7 | 2023-10-09 | Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests that no not require authentication. |
CVE-2023-43699 | High | 7.5 | 2023-10-09 | Improper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU allows an unprivileged remote attacker to guess the password via trial-and-err… |
CVE-2023-43696 | High | 8.2 | 2023-10-09 | Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary files via anonymous access to the FTP serve… |
CVE-2023-5333 | Medium | 4.3 | 2023-10-09 | Mattermost fails to deduplicate input IDs allowing a simple user to cause the application to consume excessive resources and possibly crash by sending a specia… |
CVE-2023-5331 | Medium | 4.3 | 2023-10-09 | Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information. |
CVE-2023-5330 | Medium | 4.3 | 2023-10-09 | Mattermost fails to enforce a limit for the size of the cache entry for OpenGraph data allowing an attacker to send a specially crafted request to the /api/v4… |
CVE-2023-45613 | Medium | 6.8 | 2023-10-09 | In JetBrains Ktor before 2.3.5 server certificates were not verified |
CVE-2023-45612 | High | 8.6 | 2023-10-09 | In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE |
CVE-2023-44993 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.7.8 versions. |