2023 CVEs (page 144)
Page 144 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40635 | High | 7.8 | 2023-10-08 | In linkturbo, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed |
CVE-2023-40634 | High | 7.8 | 2023-10-08 | In phasechecksercer, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges nee… |
CVE-2023-40633 | Medium | 5.5 | 2023-10-08 | In phasecheckserver, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges need… |
CVE-2023-40632 | High | 7.5 | 2023-10-08 | In jpg driver, there is a possible use after free due to a logic error. This could lead to remote information disclosure no additional execution privileges nee… |
CVE-2023-40631 | Medium | 4.4 | 2023-10-08 | In Dialer, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges needed |
CVE-2023-45199 | Critical | 9.8 | 2023-10-07 | Mbed TLS 3.2.x through 3.4.x before 3.5 has a Buffer Overflow that can lead to remote Code execution. |
CVE-2023-43615 | High | 7.5 | 2023-10-07 | Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow. |
CVE-2023-5182 | Medium | 5.5 | 2023-10-07 | Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could use this information to find hashed passwo… |
CVE-2023-36123 | High | 7.8 | 2023-10-07 | Directory Traversal vulnerability in Hex-Dragon Plain Craft Launcher 2 version Alpha 1.3.9, allows local attackers to execute arbitrary code and gain sensitive… |
CVE-2023-44860 | High | 7.5 | 2023-10-06 | An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization component in the HTTP request. |
CVE-2023-44061 | High | 8.8 | 2023-10-06 | File Upload vulnerability in Simple and Nice Shopping Cart Script v.1.0 allows a remote attacker to execute arbitrary code via the upload function in the edit… |
CVE-2023-45322 | Medium | 6.5 | 2023-10-06 | libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vend… |
CVE-2023-45311 | Critical | 9.8 | 2023-10-06 | fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any… |
CVE-2023-3725 | High | 7.6 | 2023-10-06 | Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem |
CVE-2023-5452 | Medium | 5.4 | 2023-10-06 | Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2. |
CVE-2023-45303 | High | 8.4 | 2023-10-06 | ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.te… |
CVE-2023-45282 | High | 7.5 | 2023-10-06 | In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action. |
CVE-2023-21291 | Medium | 5.5 | 2023-10-06 | In visitUris of Notification.java, there is a possible way to reveal image contents from another user due to a missing permission check. This could lead to loc… |
CVE-2023-21266 | High | 7.8 | 2023-10-06 | In multiple functions of ActivityManagerService.java, there is a possible way to escape Google Play protection due to a permissions bypass. This could lead to… |
CVE-2023-21253 | Medium | 5.5 | 2023-10-06 | In multiple locations, there is a possible way to crash multiple system services due to resource exhaustion. This could lead to local denial of service with no… |
CVE-2023-21252 | Medium | 5.5 | 2023-10-06 | In validatePassword of WifiConfigurationUtil.java, there is a possible way to get the device into a boot loop due to improper input validation. This could lead… |
CVE-2023-21244 | Medium | 6.7 | 2023-10-06 | In visitUris of Notification.java, there is a possible bypass of user profile boundaries due to a missing permission check. This could lead to local escalation… |
CVE-2023-5366 | High | 7.1 | 2023-10-06 | A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a lo… |
CVE-2023-5214 | Medium | 6.5 | 2023-10-06 | In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified. |
CVE-2023-45239 | Critical | 9.8 | 2023-10-06 | A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the… |
CVE-2023-44384 | Medium | 4.1 | 2023-10-06 | Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make a… |
CVE-2023-44807 | Critical | 9.8 | 2023-10-06 | D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the cancelPing function. |
CVE-2023-32972 | Low | 3.8 | 2023-10-06 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-32971 | Low | 3.8 | 2023-10-06 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-23371 | Medium | 5.2 | 2023-10-06 | A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow loc… |
CVE-2023-23370 | Medium | 6.7 | 2023-10-06 | An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authent… |
CVE-2023-23366 | High | 7.7 | 2023-10-06 | A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents… |
CVE-2023-23365 | High | 7.7 | 2023-10-06 | A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents… |
CVE-2023-44243 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Dylan Blokhuis Instant CSS plugin <= 1.2.1 versions. |
CVE-2023-44233 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in FooPlugins Best WordPress Gallery Plugin – FooGallery plugin <= 2.2.44 versions. |
CVE-2023-39928 | High | 8.8 | 2023-10-06 | A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5. A specially crafted web page can abuse this vulnerability to cause m… |
CVE-2023-44146 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Checkfront Inc. Checkfront Online Booking System plugin <= 3.6 versions. |
CVE-2023-41950 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Laposta - Roel Bousardt Laposta Signup Basic plugin <= 1.4.1 versions. |
CVE-2023-41801 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team Ad Directory & Listings by AWP Classifieds plugin <= 4.3 versions. |
CVE-2023-41732 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in CodePeople CP Blocks plugin <= 1.0.20 versions. |
CVE-2023-41659 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Jules Colle, BDWM Responsive Gallery Grid plugin <= 2.3.10 versions. |
CVE-2023-41654 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Andreas Heigl authLdap plugin <= 2.5.8 versions. |
CVE-2023-41650 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Remove/hide Author, Date, Category Like Entry-Meta plugin <= 2.1 versions. |
CVE-2023-40607 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in CLUEVO CLUEVO LMS, E-Learning Platform plugin <= 1.10.0 versions. |
CVE-2023-43810 | High | 7.5 | 2023-10-06 | OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting t… |
CVE-2023-43058 | Medium | 5.3 | 2023-10-06 | IBM Robotic Process Automation 23.0.9 is vulnerable to privilege escalation that affects ownership of projects. IBM X-Force ID: 247527. |
CVE-2023-42445 | Medium | 6.8 | 2023-10-06 | Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML… |
CVE-2023-38703 | Critical | 9.8 | 2023-10-06 | PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher l… |
CVE-2023-35897 | High | 8.4 | 2023-10-06 | IBM Spectrum Protect Client and IBM Storage Protect for Virtual Environments 8.1.0.0 through 8.1.19.0 could allow a local user to execute arbitrary code on the… |
CVE-2023-29235 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Fugu Maintenance Switch plugin <= 1.5.2 versions. |
CVE-2023-28791 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Gangesh Matta Simple Org Chart plugin <= 2.3.4 versions. |
CVE-2023-44771 | Medium | 5.4 | 2023-10-06 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout. |
CVE-2023-44770 | Medium | 5.4 | 2023-10-06 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spar… |
CVE-2023-44766 | Medium | 4.8 | 2023-10-06 | A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Pa… |
CVE-2023-44765 | Medium | 5.4 | 2023-10-06 | A Cross Site Scripting (XSS) vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 through 9.2.1 allows an attacker to execute arbitrary code via a… |
CVE-2023-44764 | Medium | 5.4 | 2023-10-06 | A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name parameter during installation (aka Site of Installation or Settings… |
CVE-2023-44762 | Medium | 5.4 | 2023-10-06 | A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an attacker to execute arbitrary code via a crafted script to th… |
CVE-2023-44761 | Medium | 5.4 | 2023-10-06 | Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a local attacker to ex… |
CVE-2023-40671 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in 大侠wp DX-auto-save-images plugin <= 1.4.0 versions. |
CVE-2023-40008 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Gangesh Matta Simple Org Chart plugin <= 2.3.4 versions. |
CVE-2023-27615 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Dipak C. Gajjar WP Super Minify plugin <= 1.5.1 versions. |
CVE-2023-27448 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in MakeStories Team MakeStories (for Google Web Stories) plugin <= 2.8.0 versions. |
CVE-2023-25480 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.24.1 versions. |
CVE-2023-25033 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Sumo Social Share Boost plugin <= 4.5 versions. |
CVE-2023-36465 | Critical | 9.1 | 2023-10-06 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participati… |
CVE-2023-45246 | High | 7.1 | 2023-10-06 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux… |
CVE-2023-44758 | Medium | 5.4 | 2023-10-06 | GDidees CMS 3.0 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Tit… |
CVE-2023-4530 | Critical | 9.8 | 2023-10-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Turna Advertising Administration Panel allows SQL Injecti… |
CVE-2023-4469 | Medium | 5.3 | 2023-10-06 | The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the prflxtrflds_… |
CVE-2023-45245 | Medium | 5.5 | 2023-10-06 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 36119. |
CVE-2023-45244 | High | 7.1 | 2023-10-06 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux… |
CVE-2023-40556 | Medium | 4.3 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in Greg Ross Schedule Posts Calendar plugin <= 5.2 versions. |
CVE-2023-26153 | High | 8.3 | 2023-10-06 | Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. T… |
CVE-2023-45243 | Medium | 5.5 | 2023-10-05 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) b… |
CVE-2023-45242 | Medium | 5.5 | 2023-10-05 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) b… |
CVE-2023-45241 | Medium | 5.5 | 2023-10-05 | Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35739… |
CVE-2023-45240 | Medium | 5.5 | 2023-10-05 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35739. |
CVE-2023-44214 | Medium | 5.5 | 2023-10-05 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35739. |
CVE-2023-44213 | Medium | 5.5 | 2023-10-05 | Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Protect Cloud Agent (Win… |
CVE-2023-44212 | High | 7.1 | 2023-10-05 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) befo… |
CVE-2023-44211 | High | 7.1 | 2023-10-05 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux… |
CVE-2023-43343 | Medium | 5.4 | 2023-10-05 | Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Files -… |
CVE-2023-43269 | Critical | 9.8 | 2023-10-05 | pigcms up to 7.0 was discovered to contain an arbitrary file upload vulnerability. |
CVE-2023-5441 | Medium | 5.5 | 2023-10-05 | NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960. |
CVE-2023-39323 | High | 8.1 | 2023-10-05 | Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during com… |
CVE-2023-44024 | Critical | 9.8 | 2023-10-05 | SQL injection vulnerability in KnowBand Module One Page Checkout, Social Login & Mailchimp (supercheckout) v.8.0.3 and before allows a remote attacker to execu… |
CVE-2023-43983 | Critical | 9.8 | 2023-10-05 | Presto Changeo attributegrid up to 2.0.3 was discovered to contain a SQL injection vulnerability via the component disable_json.php. |
CVE-2023-43981 | Critical | 9.8 | 2023-10-05 | Presto Changeo testsitecreator up to 1.1.1 was discovered to contain a deserialization vulnerability via the component delete_excluded_folder.php. |
CVE-2023-43284 | High | 8.8 | 2023-10-05 | D-Link Wireless MU-MIMO Gigabit AC1200 Router DIR-846 100A53DBR-Retail devices allow an authenticated remote attacker to execute arbitrary code via an unspecif… |
CVE-2023-40920 | Critical | 9.8 | 2023-10-05 | Prixan prixanconnect up to v1.62 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::importProduct… |
CVE-2023-43260 | Medium | 6.1 | 2023-10-05 | Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the admin panel. |
CVE-2023-42755 | Medium | 6.5 | 2023-10-05 | A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, le… |
CVE-2023-42754 | Medium | 5.5 | 2023-10-05 | A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __i… |
CVE-2023-41175 | Medium | 6.5 | 2023-10-05 | A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service… |
CVE-2023-40745 | Medium | 6.5 | 2023-10-05 | LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of service (application crash) or possibly execute an arbitra… |
CVE-2023-32485 | Critical | 9.8 | 2023-10-05 | Dell SmartFabric Storage Software version 1.3 and lower contain an improper input validation vulnerability. A remote unauthenticated attacker may exploit this… |
CVE-2023-5423 | Medium | 4.7 | 2023-10-05 | A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the fi… |
CVE-2023-5346 | High | 8.8 | 2023-10-05 | Type confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2023-4401 | High | 7.8 | 2023-10-05 | Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the CLI use of the ‘more’ command. A local or remote au… |
CVE-2023-44387 | Low | 3.2 | 2023-10-05 | Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves… |