2023 CVEs (page 143)
Page 143 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-44473 | Medium | 5.4 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Michael Tran Table of Contents Plus plugin <= 2302 versions. |
CVE-2023-44240 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Peter Butler Timthumb Vulnerability Scanner plugin <= 1.54 versions. |
CVE-2023-44246 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Matias s Shockingly Simple Favicon plugin <= 1.8.2 versions. |
CVE-2023-44238 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Joakim Ling Remove slug from custom post type plugin <= 1.0.3 versions. |
CVE-2023-44237 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Moriyan Jay WP Site Protector plugin <= 2.0 versions. |
CVE-2023-44236 | Medium | 5.4 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Devnath verma WP Captcha plugin <= 2.0.0 versions. |
CVE-2023-44260 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Mikk Mihkel Nurges, Rebing OÜ Woocommerce ESTO plugin <= 2.23.1 versions. |
CVE-2023-44232 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Huseyin Berberoglu WP Hide Pages plugin <= 1.0 versions. |
CVE-2023-44231 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in NickDuncan Contact Form plugin <= 2.0.10 versions. |
CVE-2023-3589 | Medium | 6.8 | 2023-10-09 | A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some ver… |
CVE-2023-39854 | Medium | 6.5 | 2023-10-09 | The web interface of ATX Ucrypt through 3.5 allows authenticated users (or attackers using default credentials for the admin, master, or user account) to inclu… |
CVE-2023-45374 | Medium | 5.3 | 2023-10-09 | An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It does not c… |
CVE-2023-45373 | Medium | 6.1 | 2023-10-09 | An issue was discovered in the ProofreadPage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. XSS can occ… |
CVE-2023-45372 | Medium | 5.3 | 2023-10-09 | An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merg… |
CVE-2023-45371 | High | 7.5 | 2023-10-09 | An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is no rate… |
CVE-2023-45370 | Medium | 5.3 | 2023-10-09 | An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. SportsTeams… |
CVE-2023-45369 | Medium | 4.3 | 2023-10-09 | An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. Usernames of h… |
CVE-2023-45367 | Medium | 6.5 | 2023-10-09 | An issue was discovered in the CheckUser extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. A user can use… |
CVE-2023-45364 | Medium | 5.3 | 2023-10-09 | An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is l… |
CVE-2023-45363 | High | 7.5 | 2023-10-09 | An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to ca… |
CVE-2023-45356 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command injection by an au… |
CVE-2023-45355 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 and 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command injection by a… |
CVE-2023-45354 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated remote attacker to execute arbitrary code on the op… |
CVE-2023-45353 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to execute arbitrary code on the operating… |
CVE-2023-45352 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to execute arbitrary code on the operating… |
CVE-2023-45351 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.1, 4000 Assistant V10 R0, 4000 Manager V10 R1 before V10 R1.42.1, and 4000 Manager V10 R0 allow Aut… |
CVE-2023-45350 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape 4000 Manager V10 R1 before V10 R1.42.1 and 4000 Manager V10 R0 allow Privilege escalation that may lead to the ability of an authenticated… |
CVE-2023-45349 | High | 7.5 | 2023-10-09 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.34.7, 4000 Assistant V10 R1.42.0, 4000 Assistant V10 R0, 4000 Manager V10 R1 before V10 R1.34.7, 4000… |
CVE-2023-40654 | Medium | 6.7 | 2023-10-08 | In FW-PackageManager, there is a possible missing permission check. This could lead to local escalation of privilege with System execution privileges needed |
CVE-2023-40653 | Medium | 6.7 | 2023-10-08 | In FW-PackageManager, there is a possible missing permission check. This could lead to local escalation of privilege with System execution privileges needed |
CVE-2023-40652 | Medium | 4.4 | 2023-10-08 | In jpg driver, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with System execution privi… |
CVE-2023-40651 | Medium | 4.4 | 2023-10-08 | In urild service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2023-40650 | Medium | 5.5 | 2023-10-08 | In Telecom service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40649 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40648 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40647 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40646 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40645 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40644 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40643 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40642 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40641 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40640 | Medium | 5.5 | 2023-10-08 | In SoundRecorder service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges |
CVE-2023-40639 | Medium | 5.5 | 2023-10-08 | In SoundRecorder service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges |
CVE-2023-40638 | Medium | 4.4 | 2023-10-08 | In Telecom service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed |
CVE-2023-40637 | Medium | 5.5 | 2023-10-08 | In telecom service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges |
CVE-2023-40636 | Medium | 4.4 | 2023-10-08 | In telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information… |
CVE-2023-40635 | High | 7.8 | 2023-10-08 | In linkturbo, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed |
CVE-2023-40634 | High | 7.8 | 2023-10-08 | In phasechecksercer, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges nee… |
CVE-2023-40633 | Medium | 5.5 | 2023-10-08 | In phasecheckserver, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges need… |
CVE-2023-40632 | High | 7.5 | 2023-10-08 | In jpg driver, there is a possible use after free due to a logic error. This could lead to remote information disclosure no additional execution privileges nee… |
CVE-2023-40631 | Medium | 4.4 | 2023-10-08 | In Dialer, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges needed |
CVE-2023-45199 | Critical | 9.8 | 2023-10-07 | Mbed TLS 3.2.x through 3.4.x before 3.5 has a Buffer Overflow that can lead to remote Code execution. |
CVE-2023-43615 | High | 7.5 | 2023-10-07 | Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow. |
CVE-2023-5182 | Medium | 5.5 | 2023-10-07 | Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could use this information to find hashed passwo… |
CVE-2023-36123 | High | 7.8 | 2023-10-07 | Directory Traversal vulnerability in Hex-Dragon Plain Craft Launcher 2 version Alpha 1.3.9, allows local attackers to execute arbitrary code and gain sensitive… |
CVE-2023-44860 | High | 7.5 | 2023-10-06 | An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization component in the HTTP request. |
CVE-2023-44061 | High | 8.8 | 2023-10-06 | File Upload vulnerability in Simple and Nice Shopping Cart Script v.1.0 allows a remote attacker to execute arbitrary code via the upload function in the edit… |
CVE-2023-45322 | Medium | 6.5 | 2023-10-06 | libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vend… |
CVE-2023-45311 | Critical | 9.8 | 2023-10-06 | fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any… |
CVE-2023-3725 | High | 7.6 | 2023-10-06 | Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem |
CVE-2023-5452 | Medium | 5.4 | 2023-10-06 | Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2. |
CVE-2023-45303 | High | 8.4 | 2023-10-06 | ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.te… |
CVE-2023-45282 | High | 7.5 | 2023-10-06 | In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action. |
CVE-2023-21291 | Medium | 5.5 | 2023-10-06 | In visitUris of Notification.java, there is a possible way to reveal image contents from another user due to a missing permission check. This could lead to loc… |
CVE-2023-21266 | High | 7.8 | 2023-10-06 | In multiple functions of ActivityManagerService.java, there is a possible way to escape Google Play protection due to a permissions bypass. This could lead to… |
CVE-2023-21253 | Medium | 5.5 | 2023-10-06 | In multiple locations, there is a possible way to crash multiple system services due to resource exhaustion. This could lead to local denial of service with no… |
CVE-2023-21252 | Medium | 5.5 | 2023-10-06 | In validatePassword of WifiConfigurationUtil.java, there is a possible way to get the device into a boot loop due to improper input validation. This could lead… |
CVE-2023-21244 | Medium | 6.7 | 2023-10-06 | In visitUris of Notification.java, there is a possible bypass of user profile boundaries due to a missing permission check. This could lead to local escalation… |
CVE-2023-5366 | High | 7.1 | 2023-10-06 | A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a lo… |
CVE-2023-5214 | Medium | 6.5 | 2023-10-06 | In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified. |
CVE-2023-45239 | Critical | 9.8 | 2023-10-06 | A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the… |
CVE-2023-44384 | Medium | 4.1 | 2023-10-06 | Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make a… |
CVE-2023-44807 | Critical | 9.8 | 2023-10-06 | D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the cancelPing function. |
CVE-2023-32972 | Low | 3.8 | 2023-10-06 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-32971 | Low | 3.8 | 2023-10-06 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-23371 | Medium | 5.2 | 2023-10-06 | A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow loc… |
CVE-2023-23370 | Medium | 6.7 | 2023-10-06 | An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authent… |
CVE-2023-23366 | High | 7.7 | 2023-10-06 | A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents… |
CVE-2023-23365 | High | 7.7 | 2023-10-06 | A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents… |
CVE-2023-44243 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Dylan Blokhuis Instant CSS plugin <= 1.2.1 versions. |
CVE-2023-44233 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in FooPlugins Best WordPress Gallery Plugin – FooGallery plugin <= 2.2.44 versions. |
CVE-2023-39928 | High | 8.8 | 2023-10-06 | A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5. A specially crafted web page can abuse this vulnerability to cause m… |
CVE-2023-44146 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Checkfront Inc. Checkfront Online Booking System plugin <= 3.6 versions. |
CVE-2023-41950 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Laposta - Roel Bousardt Laposta Signup Basic plugin <= 1.4.1 versions. |
CVE-2023-41801 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team Ad Directory & Listings by AWP Classifieds plugin <= 4.3 versions. |
CVE-2023-41732 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in CodePeople CP Blocks plugin <= 1.0.20 versions. |
CVE-2023-41659 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Jules Colle, BDWM Responsive Gallery Grid plugin <= 2.3.10 versions. |
CVE-2023-41654 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Andreas Heigl authLdap plugin <= 2.5.8 versions. |
CVE-2023-41650 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Remove/hide Author, Date, Category Like Entry-Meta plugin <= 2.1 versions. |
CVE-2023-40607 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in CLUEVO CLUEVO LMS, E-Learning Platform plugin <= 1.10.0 versions. |
CVE-2023-43810 | High | 7.5 | 2023-10-06 | OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting t… |
CVE-2023-43058 | Medium | 5.3 | 2023-10-06 | IBM Robotic Process Automation 23.0.9 is vulnerable to privilege escalation that affects ownership of projects. IBM X-Force ID: 247527. |
CVE-2023-42445 | Medium | 6.8 | 2023-10-06 | Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML… |
CVE-2023-38703 | Critical | 9.8 | 2023-10-06 | PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher l… |
CVE-2023-35897 | High | 8.4 | 2023-10-06 | IBM Spectrum Protect Client and IBM Storage Protect for Virtual Environments 8.1.0.0 through 8.1.19.0 could allow a local user to execute arbitrary code on the… |
CVE-2023-29235 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Fugu Maintenance Switch plugin <= 1.5.2 versions. |
CVE-2023-28791 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Gangesh Matta Simple Org Chart plugin <= 2.3.4 versions. |
CVE-2023-44771 | Medium | 5.4 | 2023-10-06 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout. |
CVE-2023-44770 | Medium | 5.4 | 2023-10-06 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spar… |