2023 CVEs (page 144)
Page 144 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-44766 | Medium | 4.8 | 2023-10-06 | A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Pa… |
CVE-2023-44765 | Medium | 5.4 | 2023-10-06 | A Cross Site Scripting (XSS) vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 through 9.2.1 allows an attacker to execute arbitrary code via a… |
CVE-2023-44764 | Medium | 5.4 | 2023-10-06 | A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name parameter during installation (aka Site of Installation or Settings… |
CVE-2023-44762 | Medium | 5.4 | 2023-10-06 | A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an attacker to execute arbitrary code via a crafted script to th… |
CVE-2023-44761 | Medium | 5.4 | 2023-10-06 | Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a local attacker to ex… |
CVE-2023-40671 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in 大侠wp DX-auto-save-images plugin <= 1.4.0 versions. |
CVE-2023-40008 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Gangesh Matta Simple Org Chart plugin <= 2.3.4 versions. |
CVE-2023-27615 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Dipak C. Gajjar WP Super Minify plugin <= 1.5.1 versions. |
CVE-2023-27448 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in MakeStories Team MakeStories (for Google Web Stories) plugin <= 2.8.0 versions. |
CVE-2023-25480 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.24.1 versions. |
CVE-2023-25033 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Sumo Social Share Boost plugin <= 4.5 versions. |
CVE-2023-36465 | Critical | 9.1 | 2023-10-06 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participati… |
CVE-2023-45246 | High | 7.1 | 2023-10-06 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux… |
CVE-2023-44758 | Medium | 5.4 | 2023-10-06 | GDidees CMS 3.0 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Tit… |
CVE-2023-4530 | Critical | 9.8 | 2023-10-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Turna Advertising Administration Panel allows SQL Injecti… |
CVE-2023-4469 | Medium | 5.3 | 2023-10-06 | The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the prflxtrflds_… |
CVE-2023-45245 | Medium | 5.5 | 2023-10-06 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 36119. |
CVE-2023-45244 | High | 7.1 | 2023-10-06 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux… |
CVE-2023-40556 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Greg Ross Schedule Posts Calendar plugin <= 5.2 versions. |
CVE-2023-26153 | High | 8.3 | 2023-10-06 | Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. T… |
CVE-2023-45243 | Medium | 5.5 | 2023-10-05 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) b… |
CVE-2023-45242 | Medium | 5.5 | 2023-10-05 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) b… |
CVE-2023-45241 | Medium | 5.5 | 2023-10-05 | Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35739… |
CVE-2023-45240 | Medium | 5.5 | 2023-10-05 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35739. |
CVE-2023-44214 | Medium | 5.5 | 2023-10-05 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35739. |
CVE-2023-44213 | Medium | 5.5 | 2023-10-05 | Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Protect Cloud Agent (Win… |
CVE-2023-44212 | High | 7.1 | 2023-10-05 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) befo… |
CVE-2023-44211 | High | 7.1 | 2023-10-05 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux… |
CVE-2023-43343 | Medium | 5.4 | 2023-10-05 | Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Files -… |
CVE-2023-43269 | Critical | 9.8 | 2023-10-05 | pigcms up to 7.0 was discovered to contain an arbitrary file upload vulnerability. |
CVE-2023-5441 | Medium | 5.5 | 2023-10-05 | NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960. |
CVE-2023-39323 | High | 8.1 | 2023-10-05 | Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during com… |
CVE-2023-44024 | Critical | 9.8 | 2023-10-05 | SQL injection vulnerability in KnowBand Module One Page Checkout, Social Login & Mailchimp (supercheckout) v.8.0.3 and before allows a remote attacker to execu… |
CVE-2023-43983 | Critical | 9.8 | 2023-10-05 | Presto Changeo attributegrid up to 2.0.3 was discovered to contain a SQL injection vulnerability via the component disable_json.php. |
CVE-2023-43981 | Critical | 9.8 | 2023-10-05 | Presto Changeo testsitecreator up to 1.1.1 was discovered to contain a deserialization vulnerability via the component delete_excluded_folder.php. |
CVE-2023-43284 | High | 8.8 | 2023-10-05 | D-Link Wireless MU-MIMO Gigabit AC1200 Router DIR-846 100A53DBR-Retail devices allow an authenticated remote attacker to execute arbitrary code via an unspecif… |
CVE-2023-40920 | Critical | 9.8 | 2023-10-05 | Prixan prixanconnect up to v1.62 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::importProduct… |
CVE-2023-43260 | Medium | 6.1 | 2023-10-05 | Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the admin panel. |
CVE-2023-42755 | Medium | 6.5 | 2023-10-05 | A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, le… |
CVE-2023-42754 | Medium | 5.5 | 2023-10-05 | A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __i… |
CVE-2023-41175 | Medium | 6.5 | 2023-10-05 | A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service… |
CVE-2023-40745 | Medium | 6.5 | 2023-10-05 | LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of service (application crash) or possibly execute an arbitra… |
CVE-2023-32485 | Critical | 9.8 | 2023-10-05 | Dell SmartFabric Storage Software version 1.3 and lower contain an improper input validation vulnerability. A remote unauthenticated attacker may exploit this… |
CVE-2023-5423 | Medium | 4.7 | 2023-10-05 | A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the fi… |
CVE-2023-5346 | High | 8.8 | 2023-10-05 | Type confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2023-4401 | High | 7.8 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the CLI use of the ‘more’ command. A local or remote au… |
CVE-2023-44387 | Low | 3.2 | 2023-10-05 | Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves… |
CVE-2023-44386 | Medium | 5.3 | 2023-10-05 | Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler… |
CVE-2023-43073 | Medium | 4.3 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains an Improper Input Validation vulnerability in RADIUS configuration. An authenticated remote atta… |
CVE-2023-43072 | Medium | 4.4 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains an improper access control vulnerability in the CLI. A local possibly unauthenticated attacker c… |
CVE-2023-43071 | Medium | 4.4 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to cro… |
CVE-2023-43070 | Medium | 6.3 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains a Path Traversal Vulnerability in the HTTP interface. A remote authenticated attacker could pote… |
CVE-2023-43069 | High | 7.8 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contain(s) an OS Command Injection Vulnerability in the CLI. An authenticated local attacker could potent… |
CVE-2023-43068 | High | 7.8 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the restricted shell in SSH. An authenticated remote at… |
CVE-2023-2306 | Critical | 10.0 | 2023-10-05 | Qognify NiceVision versions 3.1 and prior are vulnerable to exposing sensitive information using hard-coded credentials. With these credentials an attacke… |
CVE-2023-4570 | High | 8.8 | 2023-10-05 | An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. Th… |
CVE-2023-45160 | High | 8.8 | 2023-10-05 | In the affected version of the 1E Client, an ordinary user could subvert downloaded instruction resource files, e.g., to substitute a harmful script. by replac… |
CVE-2023-44839 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Encryption parameter in the SetWLanRadioSecurity function. This vulnerability a… |
CVE-2023-44838 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the TXPower parameter in the SetWLanRadioSettings function. This vulnerability allo… |
CVE-2023-44837 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Password parameter in the SetWanSettings function. This vulnerability allows at… |
CVE-2023-44836 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the SSID parameter in the SetWLanRadioSettings function. This vulnerability allows… |
CVE-2023-44835 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Mac parameter in the SetParentsControlInfo function. This vulnerability allows… |
CVE-2023-44834 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the StartTime parameter in the SetParentsControlInfo function. This vulnerability a… |
CVE-2023-44833 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the GuardInt parameter in the SetWLanRadioSettings function. This vulnerability all… |
CVE-2023-44832 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the MacAddress parameter in the SetWanSettings function. This vulnerability allows… |
CVE-2023-44831 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Type parameter in the SetWLanRadioSettings function. This vulnerability allows… |
CVE-2023-44830 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the EndTime parameter in the SetParentsControlInfo function. This vulnerability all… |
CVE-2023-44829 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the AdminPassword parameter in the SetDeviceSettings function. This vulnerability a… |
CVE-2023-44828 | High | 7.5 | 2023-10-05 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the CurrentPassword parameter in the CheckPasswdSettings function. This vulnerabili… |
CVE-2023-44390 | Medium | 6.1 | 2023-10-05 | HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurati… |
CVE-2023-45159 | High | 8.4 | 2023-10-05 | 1E Client installer can perform arbitrary file deletion on protected files. A non-privileged user could provide a symbolic link or Windows junction to point… |
CVE-2023-45198 | High | 7.5 | 2023-10-05 | ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd (the portable versi… |
CVE-2023-26239 | Medium | 5.5 | 2023-10-05 | An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of a password check, it is possible to obtain credentials to access the ma… |
CVE-2023-26238 | Medium | 5.5 | 2023-10-05 | An issue was discovered in WatchGuard EPDR 8.0.21.0002. It is possible to enable or disable defensive capabilities by sending a crafted message to a named pipe. |
CVE-2023-26237 | Medium | 6.7 | 2023-10-05 | An issue was discovered in WatchGuard EPDR 8.0.21.0002. It is possible to bypass the defensive capabilities by adding a registry key as SYSTEM. |
CVE-2023-26236 | High | 7.8 | 2023-10-05 | An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of message handling between WatchGuard EPDR processes, it is possible to p… |
CVE-2023-43877 | Medium | 4.8 | 2023-10-04 | Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a payload crafted in the Home Page fiel… |
CVE-2023-43321 | High | 8.8 | 2023-10-04 | File Upload vulnerability in Digital China Networks DCFW-1800-SDC v.3.0 allows an authenticated attacker to execute arbitrary code via the wget function in the… |
CVE-2023-40299 | High | 7.8 | 2023-10-04 | Kong Insomnia 2023.4.0 on macOS allows attackers to execute code and access restricted files, or make requests for TCC permissions, by using the DYLD_INSERT_LI… |
CVE-2023-35803 | Critical | 9.8 | 2023-10-04 | IQ Engine before 10.6r2 on Extreme Network AP devices has a Buffer Overflow. |
CVE-2023-44389 | Low | 3.1 | 2023-10-04 | Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while view… |
CVE-2023-43809 | High | 7.5 | 2023-10-04 | Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an unauthenticated, r… |
CVE-2023-43805 | High | 7.5 | 2023-10-04 | Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypas… |
CVE-2023-43799 | Medium | 5.0 | 2023-10-04 | Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the un… |
CVE-2023-43793 | High | 7.5 | 2023-10-04 | Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull… |
CVE-2023-41094 | Critical | 10.0 | 2023-10-04 | TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifet… |
CVE-2023-36619 | Critical | 9.8 | 2023-10-04 | Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of administrative scripts by unauthenticated users. |
CVE-2023-36618 | High | 8.8 | 2023-10-04 | Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of OS commands as root user by low-privileged authenticated users. |
CVE-2023-44210 | Medium | 5.5 | 2023-10-04 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux… |
CVE-2023-44209 | High | 7.8 | 2023-10-04 | Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) b… |
CVE-2023-44075 | Medium | 5.4 | 2023-10-04 | Cross Site Scripting vulnerability in Small CRM in PHP v.3.0 allows a remote attacker to execute arbitrary code via a crafted payload to the Address parameter. |
CVE-2023-42809 | Critical | 9.6 | 2023-10-04 | Redisson is a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some of the messages received from the Redis server contain Java object… |
CVE-2023-42808 | Medium | 6.1 | 2023-10-04 | Common Voice is the web app for Mozilla Common Voice, a platform for collecting speech donations in order to create public domain datasets for training voice r… |
CVE-2023-42449 | High | 8.1 | 2023-10-04 | Hydra is the two-layer scalability solution for Cardano. Prior to version 0.13.0, it is possible for a malicious head initializer to extract one or more PTs fo… |
CVE-2023-38538 | Medium | 5.0 | 2023-10-04 | A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexp… |
CVE-2023-38537 | Medium | 5.6 | 2023-10-04 | A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls that could have re… |
CVE-2023-5399 | Critical | 9.8 | 2023-10-04 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause tampering of files on the p… |
CVE-2023-5391 | Critical | 9.8 | 2023-10-04 | A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted system by sending a… |
CVE-2023-42824 | High | 7.8 | 2023-10-04 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Ap… |
CVE-2023-42448 | High | 8.1 | 2023-10-04 | Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTx… |