2023 CVEs (page 143)
Page 143 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-44847 | High | 7.2 | 2023-10-10 | An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ Weixin.php component. |
CVE-2023-44846 | High | 8.8 | 2023-10-10 | An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ notify.php component. |
CVE-2023-5463 | High | 7.8 | 2023-10-09 | A vulnerability was found in XINJE XDPPro up to 3.7.17a. It has been rated as critical. Affected by this issue is some unknown functionality in the library cfg… |
CVE-2023-5462 | Medium | 6.5 | 2023-10-09 | A vulnerability was found in XINJE XD5E-30R-E 3.5.3b. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the compo… |
CVE-2023-43899 | Critical | 9.8 | 2023-10-09 | hansun CMS v1.0 was discovered to contain a SQL injection vulnerability via the component /ajax/ajax_login.ashx. |
CVE-2023-43641 | High | 8.8 | 2023-10-09 | libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GN… |
CVE-2023-44813 | Medium | 6.1 | 2023-10-09 | Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of… |
CVE-2023-44812 | Medium | 6.1 | 2023-10-09 | Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the admin_redirect_ur… |
CVE-2023-43271 | Critical | 9.1 | 2023-10-09 | Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other p… |
CVE-2023-5461 | Low | 3.7 | 2023-10-09 | A vulnerability was found in Delta Electronics WPLSoft 2.51. It has been classified as problematic. Affected is an unknown function of the component Modbus Han… |
CVE-2023-44821 | Medium | 5.5 | 2023-10-09 | Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE… |
CVE-2023-44811 | High | 8.8 | 2023-10-09 | Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via th… |
CVE-2023-44467 | Critical | 9.8 | 2023-10-09 | langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code… |
CVE-2023-44392 | High | 8.2 | 2023-10-09 | Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is… |
CVE-2023-5460 | Low | 3.5 | 2023-10-09 | A vulnerability was found in Delta Electronics WPLSoft up to 2.51 and classified as problematic. This issue affects some unknown processing of the component Mo… |
CVE-2023-5459 | Medium | 6.5 | 2023-10-09 | A vulnerability has been found in Delta Electronics DVP32ES2 PLC 1.48 and classified as critical. This vulnerability affects unknown code of the component Pass… |
CVE-2023-41672 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Rémi Leclercq Hide admin notices – Admin Notification Center plugin <= 2.3.2 versions. |
CVE-2023-41670 | Medium | 5.4 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Palasthotel (in person: Edward Bock) Use Memcached plugin <= 1.0.4 versions. |
CVE-2023-41669 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Live News plugin <= 1.06 versions. |
CVE-2023-41668 | Medium | 5.4 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <= 1.1.2 versions. |
CVE-2023-41667 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Ulf Benjaminsson WP-dTree plugin <= 4.4.5 versions. |
CVE-2023-39194 | Low | 3.2 | 2023-10-09 | A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past th… |
CVE-2023-39193 | Medium | 6.1 | 2023-10-09 | A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (… |
CVE-2023-39192 | Medium | 6.7 | 2023-10-09 | A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a loca… |
CVE-2023-39189 | Medium | 5.1 | 2023-10-09 | A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. Th… |
CVE-2023-42455 | High | 8.8 | 2023-10-09 | Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator k… |
CVE-2023-5365 | Critical | 9.8 | 2023-10-09 | HP LIFE Android Mobile application is potentially vulnerable to escalation of privilege and/or information disclosure. |
CVE-2023-44400 | Medium | 6.7 | 2023-10-09 | Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is cau… |
CVE-2023-41047 | Medium | 6.2 | 2023-10-09 | OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious admins to configure… |
CVE-2023-30910 | Medium | 5.4 | 2023-10-09 | HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests. |
CVE-2023-44393 | Critical | 9.3 | 2023-10-09 | Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?pa… |
CVE-2023-44378 | High | 7.1 | 2023-10-09 | gnark is a zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.9.0, for some in-circuit values, it is possible to construct tw… |
CVE-2023-43643 | Medium | 6.1 | 2023-10-09 | AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mut… |
CVE-2023-41660 | Medium | 6.5 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in WPSynchro WP Synchro plugin <= 1.9.1 versions. |
CVE-2023-36820 | Medium | 4.8 | 2023-10-09 | Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1… |
CVE-2023-25822 | Medium | 6.3 | 2023-10-09 | ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the `com.epam.reportportal:service-api` module, corresponding to ReportPorta… |
CVE-2023-5103 | Medium | 4.3 | 2023-10-09 | Improper Restriction of Rendered UI Layers or Frames in RDT400 in SICK APU allows an unprivileged remote attacker to potentially reveal sensitive information v… |
CVE-2023-5102 | Medium | 5.3 | 2023-10-09 | Insufficient Control Flow Management in RDT400 in SICK APU allows an unprivileged remote attacker to potentially enable hidden functionality via HTTP requests… |
CVE-2023-5101 | Medium | 5.3 | 2023-10-09 | Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files from the server via… |
CVE-2023-5100 | Medium | 5.9 | 2023-10-09 | Cleartext Transmission of Sensitive Information in RDT400 in SICK APU allows an unprivileged remote attacker to retrieve potentially sensitive information via… |
CVE-2023-43698 | High | 7.1 | 2023-10-09 | Improper Neutralization of Input During Web Page Generation (’Cross-site Scripting’) in RDT400 in SICK APU allows an unprivileged remote attacker to run arbit… |
CVE-2023-43697 | Medium | 6.5 | 2023-10-09 | Modification of Assumed-Immutable Data (MAID) in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load necessary strings v… |
CVE-2023-45248 | High | 7.3 | 2023-10-09 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 36… |
CVE-2023-45247 | High | 7.1 | 2023-10-09 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux… |
CVE-2023-43700 | High | 7.7 | 2023-10-09 | Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests that no not require authentication. |
CVE-2023-43699 | High | 7.5 | 2023-10-09 | Improper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU allows an unprivileged remote attacker to guess the password via trial-and-err… |
CVE-2023-43696 | High | 8.2 | 2023-10-09 | Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary files via anonymous access to the FTP serve… |
CVE-2023-5333 | Medium | 4.3 | 2023-10-09 | Mattermost fails to deduplicate input IDs allowing a simple user to cause the application to consume excessive resources and possibly crash by sending a specia… |
CVE-2023-5331 | Medium | 4.3 | 2023-10-09 | Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information. |
CVE-2023-5330 | Medium | 4.3 | 2023-10-09 | Mattermost fails to enforce a limit for the size of the cache entry for OpenGraph data allowing an attacker to send a specially crafted request to the /api/v4… |
CVE-2023-45613 | Medium | 6.8 | 2023-10-09 | In JetBrains Ktor before 2.3.5 server certificates were not verified |
CVE-2023-45612 | High | 8.6 | 2023-10-09 | In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE |
CVE-2023-44993 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.7.8 versions. |
CVE-2023-44473 | Medium | 5.4 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Michael Tran Table of Contents Plus plugin <= 2302 versions. |
CVE-2023-44240 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Peter Butler Timthumb Vulnerability Scanner plugin <= 1.54 versions. |
CVE-2023-44246 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Matias s Shockingly Simple Favicon plugin <= 1.8.2 versions. |
CVE-2023-44238 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Joakim Ling Remove slug from custom post type plugin <= 1.0.3 versions. |
CVE-2023-44237 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Moriyan Jay WP Site Protector plugin <= 2.0 versions. |
CVE-2023-44236 | Medium | 5.4 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Devnath verma WP Captcha plugin <= 2.0.0 versions. |
CVE-2023-44260 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Mikk Mihkel Nurges, Rebing OÜ Woocommerce ESTO plugin <= 2.23.1 versions. |
CVE-2023-44232 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in Huseyin Berberoglu WP Hide Pages plugin <= 1.0 versions. |
CVE-2023-44231 | Medium | 4.3 | 2023-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in NickDuncan Contact Form plugin <= 2.0.10 versions. |
CVE-2023-3589 | Medium | 6.8 | 2023-10-09 | A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some ver… |
CVE-2023-39854 | Medium | 6.5 | 2023-10-09 | The web interface of ATX Ucrypt through 3.5 allows authenticated users (or attackers using default credentials for the admin, master, or user account) to inclu… |
CVE-2023-45374 | Medium | 5.3 | 2023-10-09 | An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It does not c… |
CVE-2023-45373 | Medium | 6.1 | 2023-10-09 | An issue was discovered in the ProofreadPage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. XSS can occ… |
CVE-2023-45372 | Medium | 5.3 | 2023-10-09 | An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merg… |
CVE-2023-45371 | High | 7.5 | 2023-10-09 | An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is no rate… |
CVE-2023-45370 | Medium | 5.3 | 2023-10-09 | An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. SportsTeams… |
CVE-2023-45369 | Medium | 4.3 | 2023-10-09 | An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. Usernames of h… |
CVE-2023-45367 | Medium | 6.5 | 2023-10-09 | An issue was discovered in the CheckUser extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. A user can use… |
CVE-2023-45364 | Medium | 5.3 | 2023-10-09 | An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is l… |
CVE-2023-45363 | High | 7.5 | 2023-10-09 | An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to ca… |
CVE-2023-45356 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command injection by an au… |
CVE-2023-45355 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 and 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command injection by a… |
CVE-2023-45354 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated remote attacker to execute arbitrary code on the op… |
CVE-2023-45353 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to execute arbitrary code on the operating… |
CVE-2023-45352 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to execute arbitrary code on the operating… |
CVE-2023-45351 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.1, 4000 Assistant V10 R0, 4000 Manager V10 R1 before V10 R1.42.1, and 4000 Manager V10 R0 allow Aut… |
CVE-2023-45350 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape 4000 Manager V10 R1 before V10 R1.42.1 and 4000 Manager V10 R0 allow Privilege escalation that may lead to the ability of an authenticated… |
CVE-2023-45349 | High | 7.5 | 2023-10-09 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.34.7, 4000 Assistant V10 R1.42.0, 4000 Assistant V10 R0, 4000 Manager V10 R1 before V10 R1.34.7, 4000… |
CVE-2023-40654 | Medium | 6.7 | 2023-10-08 | In FW-PackageManager, there is a possible missing permission check. This could lead to local escalation of privilege with System execution privileges needed |
CVE-2023-40653 | Medium | 6.7 | 2023-10-08 | In FW-PackageManager, there is a possible missing permission check. This could lead to local escalation of privilege with System execution privileges needed |
CVE-2023-40652 | Medium | 4.4 | 2023-10-08 | In jpg driver, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with System execution privi… |
CVE-2023-40651 | Medium | 4.4 | 2023-10-08 | In urild service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2023-40650 | Medium | 5.5 | 2023-10-08 | In Telecom service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40649 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40648 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40647 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40646 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40645 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40644 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40643 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40642 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40641 | Medium | 5.5 | 2023-10-08 | In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed |
CVE-2023-40640 | Medium | 5.5 | 2023-10-08 | In SoundRecorder service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges |
CVE-2023-40639 | Medium | 5.5 | 2023-10-08 | In SoundRecorder service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges |
CVE-2023-40638 | Medium | 4.4 | 2023-10-08 | In Telecom service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed |
CVE-2023-40637 | Medium | 5.5 | 2023-10-08 | In telecom service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges |
CVE-2023-40636 | Medium | 4.4 | 2023-10-08 | In telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information… |