2023 CVEs (page 145)
Page 145 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-3576 | Medium | 5.5 | 2023-10-04 | A memory leak flaw was found in Libtiff's tiffcrop utility. This issue occurs when tiffcrop operates on a TIFF image file, allowing an attacker to pass a craft… |
CVE-2023-3428 | Medium | 6.2 | 2023-10-04 | A heap-based buffer overflow vulnerability was found in coders/tiff.c in ImageMagick. This issue may allow a local attacker to trick the user into opening a s… |
CVE-2023-39191 | High | 8.2 | 2023-10-04 | An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers… |
CVE-2023-38701 | Critical | 9.1 | 2023-10-04 | Hydra is the layer-two scalability solution for Cardano. Users of the Hydra head protocol send the UTxOs they wish to commit into the Hydra head first to the `… |
CVE-2023-27121 | Medium | 6.1 | 2023-10-04 | A cross-site scripting (XSS) vulnerability in the component /framework/cron/action/humanize of Pleasant Solutions Pleasant Password Server v7.11.41.0 allows at… |
CVE-2023-5402 | Critical | 9.8 | 2023-10-04 | A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used over the network. |
CVE-2023-5371 | Medium | 5.3 | 2023-10-04 | RTPS dissector memory leak in Wireshark 4.0.0 to 4.0.8 and 3.6.0 to 3.6.16 allows denial of service via packet injection or crafted capture file |
CVE-2023-43804 | Medium | 5.9 | 2023-10-04 | urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies o… |
CVE-2023-20259 | High | 8.6 | 2023-10-04 | A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU utilizat… |
CVE-2023-20235 | Medium | 6.5 | 2023-10-04 | A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could a… |
CVE-2023-20101 | Critical | 9.8 | 2023-10-04 | A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has… |
CVE-2023-43838 | High | 7.8 | 2023-10-04 | An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a… |
CVE-2023-5113 | Medium | 6.1 | 2023-10-04 | Certain HP Enterprise LaserJet and HP LaserJet Managed Printers are potentially vulnerable to denial of service due to WS-Print request and potential injection… |
CVE-2023-4380 | Medium | 6.3 | 2023-10-04 | A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw a… |
CVE-2023-4237 | High | 7.3 | 2023-10-04 | A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output… |
CVE-2023-40559 | Medium | 4.3 | 2023-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Dynamic Pricing and Discount Rules for WooCommerce plugin <= 2.4.0 versions. |
CVE-2023-3971 | High | 7.3 | 2023-10-04 | An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login p… |
CVE-2023-3665 | Medium | 5.5 | 2023-10-04 | A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment va… |
CVE-2023-5374 | Medium | 6.3 | 2023-10-04 | A vulnerability classified as critical was found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this vulnerability is an unknown functiona… |
CVE-2023-40684 | Medium | 4.6 | 2023-10-04 | IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. This vulnerability allows users to embed… |
CVE-2023-40561 | Medium | 5.4 | 2023-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Enhanced Ecommerce Google Analytics for WooCommerce plugin <= 3.7.1 versions. |
CVE-2023-40376 | Medium | 5.3 | 2023-10-04 | IBM UrbanCode Deploy (UCD) 7.1 - 7.1.2.12, 7.2 through 7.2.3.5, and 7.3 through 7.3.2.0 under certain configurations could allow an authenticated user to make… |
CVE-2023-27433 | Medium | 5.4 | 2023-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in YAS Global Team Make Paths Relative allows Cross Site Request Forgery.This issue affects Make Paths Relative… |
CVE-2023-25025 | Medium | 4.3 | 2023-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions. |
CVE-2023-22515 | Critical | 9.8 | 2023-10-04 | Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in… |
CVE-2023-1832 | Medium | 6.8 | 2023-10-04 | An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confident… |
CVE-2023-5373 | High | 7.3 | 2023-10-04 | A vulnerability classified as critical has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected is the function register of the file Mas… |
CVE-2023-4497 | Medium | 6.1 | 2023-10-04 | Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability… |
CVE-2023-4496 | Medium | 6.1 | 2023-10-04 | Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability… |
CVE-2023-4495 | Medium | 6.1 | 2023-10-04 | Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability… |
CVE-2023-4494 | Critical | 9.8 | 2023-10-04 | Stack-based buffer overflow vulnerability in Easy Chat Server 3.1 version. An attacker could send an excessively long username string to the register.ghp file… |
CVE-2023-4493 | Medium | 6.1 | 2023-10-04 | Stored Cross-Site Scripting in Easy Address Book Web Server 1.6 version, through the users_admin.ghp file that affects multiple parameters such as (firstname… |
CVE-2023-4492 | Medium | 6.1 | 2023-10-04 | Vulnerability in Easy Address Book Web Server 1.6 version, affecting the parameters (firstname, homephone, lastname, middlename, workaddress, workcity, workcou… |
CVE-2023-4491 | Critical | 9.8 | 2023-10-04 | Buffer overflow vulnerability in Easy Address Book Web Server 1.6 version. The exploitation of this vulnerability could allow an attacker to send a very long u… |
CVE-2023-4090 | Medium | 5.4 | 2023-10-04 | Cross-site Scripting (XSS) reflected vulnerability on WideStand until 5.3.5 version, which generates one of the meta tags directly using the content of the que… |
CVE-2023-4037 | Critical | 9.9 | 2023-10-04 | Blind SQL injection vulnerability in the Conacwin 3.7.1.2 web interface, the exploitation of which could allow a local attacker to obtain sensitive data stored… |
CVE-2023-44208 | Critical | 9.1 | 2023-10-04 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Home Office (Windows… |
CVE-2023-43261 | High | 7.5 | 2023-10-04 | An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components. |
CVE-2023-3361 | High | 7.7 | 2023-10-04 | A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 creden… |
CVE-2023-3153 | Medium | 5.3 | 2023-10-04 | A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of se… |
CVE-2023-3038 | Critical | 9.8 | 2023-10-04 | SQL injection vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to send a specially crafted SQL qu… |
CVE-2023-3037 | High | 8.6 | 2023-10-04 | Improper authorization vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to access the platform wi… |
CVE-2023-22618 | High | 8.1 | 2023-10-04 | If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative privileges by manip… |
CVE-2023-4997 | High | 8.8 | 2023-10-04 | Improper authorisation of regular users in ProIntegra Uptime DC software (versions below 2.0.0.33940) allows them to change passwords of all other users includ… |
CVE-2023-4586 | High | 7.4 | 2023-10-04 | A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly… |
CVE-2023-3701 | Critical | 9.9 | 2023-10-04 | Aqua Drive, in its 2.4 version, is vulnerable to a relative path traversal vulnerability. By exploiting this vulnerability, an authenticated non privileged use… |
CVE-2023-3512 | High | 7.5 | 2023-10-04 | Relative path traversal vulnerability in Setelsa Security's ConacWin CB, in its 3.8.2.2 version and earlier, the exploitation of which could allow an attacker… |
CVE-2023-37995 | Medium | 4.3 | 2023-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions. |
CVE-2023-2809 | High | 7.8 | 2023-10-04 | Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQL database… |
CVE-2023-2422 | Medium | 5.5 | 2023-10-04 | A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certific… |
CVE-2023-25980 | Medium | 4.3 | 2023-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in CAGE Web Design | Rolf van Gelder Optimize Database after Deleting Revisions plugin <= 5.1 versions. |
CVE-2023-25788 | Medium | 6.3 | 2023-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in Saphali Saphali Woocommerce Lite plugin <= 1.8.13 versions. |
CVE-2023-25489 | Medium | 4.3 | 2023-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in Jeff Sherk Update Theme and Plugins from Zip File plugin <= 2.0.0 versions. |
CVE-2023-1584 | High | 7.5 | 2023-10-04 | A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can a… |
CVE-2023-5377 | High | 7.1 | 2023-10-04 | Out-of-bounds Read in GitHub repository gpac/gpac prior to v2.2.2-DEV. |
CVE-2023-5375 | Medium | 6.1 | 2023-10-04 | Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2. |
CVE-2023-44272 | Medium | 5.4 | 2023-10-04 | A cross-site scripting vulnerability exists in Citadel versions prior to 994. When a malicious user sends an instant message with some JavaScript code, the scr… |
CVE-2023-5370 | Medium | 5.5 | 2023-10-04 | On CPU 0 the check for the SMCCC workaround is called before SMCCC support has been initialized. This resulted in no speculative execution workarounds being in… |
CVE-2023-5369 | High | 7.1 | 2023-10-04 | Before correction, the copy_file_range system call checked only for the CAP_READ and CAP_WRITE capabilities on the input and output file descriptors, respectiv… |
CVE-2023-5368 | Medium | 6.5 | 2023-10-04 | On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances populate the additional space in the file with unallocated dat… |
CVE-2023-30738 | Medium | 5.5 | 2023-10-04 | An improper input validation in UEFI Firmware prior to Firmware update Oct-2023 Release in Galaxy Book, Galaxy Book Pro, Galaxy Book Pro 360 and Galaxy Book Od… |
CVE-2023-30737 | Medium | 4.0 | 2023-10-04 | Improper access control vulnerability in Samsung Health prior to version 6.24.3.007 allows attackers to access sensitive information via implicit intent. |
CVE-2023-30736 | Medium | 4.4 | 2023-10-04 | Improper authorization in PushMsgReceiver of Samsung Assistant prior to version 8.7.00.1 allows attacker to execute javascript interface. To trigger this vulne… |
CVE-2023-30735 | Medium | 5.1 | 2023-10-04 | Improper Preservation of Permissions vulnerability in SAssistant prior to version 8.7 allows local attackers to access backup data in SAssistant. |
CVE-2023-30734 | Medium | 4.0 | 2023-10-04 | Improper access control vulnerability in Samsung Health prior to version 6.24.3.007 allows attackers to access sensitive information via implicit intent. |
CVE-2023-30733 | High | 7.8 | 2023-10-04 | Stack-based Buffer Overflow in vulnerability HDCP trustlet prior to SMR Oct-2023 Release 1 allows local privileged attackers to perform code execution. |
CVE-2023-30732 | Medium | 5.5 | 2023-10-04 | Improper access control in system property prior to SMR Oct-2023 Release 1 allows local attacker to get CPU serial number. |
CVE-2023-30731 | Medium | 5.7 | 2023-10-04 | Logic error in package installation via debugger command prior to SMR Oct-2023 Release 1 allows physical attacker to install an application that has different… |
CVE-2023-30727 | Medium | 6.7 | 2023-10-04 | Improper access control vulnerability in SecSettings prior to SMR Oct-2023 Release 1 allows attackers to enable Wi-Fi and connect arbitrary Wi-Fi without User… |
CVE-2023-30692 | High | 8.5 | 2023-10-04 | Improper input validation vulnerability in Evaluator prior to SMR Oct-2023 Release 1 allows local attackers to launch privileged activities. |
CVE-2023-30690 | High | 8.5 | 2023-10-04 | Improper input validation vulnerability in Duo prior to SMR Oct-2023 Release 1 allows local attackers to launch privileged activities. |
CVE-2023-5357 | Medium | 6.4 | 2023-10-04 | The Instagram for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.6 due to ins… |
CVE-2023-5291 | Medium | 6.4 | 2023-10-04 | The Blog Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'AWL-BlogFilter' shortcode in versions up to, and including, 1.5.3 due to… |
CVE-2023-3213 | Medium | 5.3 | 2023-10-04 | The WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_print_page function in versi… |
CVE-2023-37404 | Medium | 6.4 | 2023-10-04 | IBM Observability with Instana 1.0.243 through 1.0.254 could allow an attacker on the network to execute arbitrary code on the host after a successful DNS pois… |
CVE-2023-35905 | Medium | 4.6 | 2023-10-04 | IBM FileNet Content Manager 5.5.8, 5.5.10, and 5.5.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2023-39647 | Critical | 9.8 | 2023-10-03 | Improper neutralization of SQL parameter in Theme Volty CMS Category Product module for PrestaShop. In the module “Theme Volty CMS Category Product” (tvcmscate… |
CVE-2023-39651 | Critical | 9.8 | 2023-10-03 | Improper neutralization of SQL parameter in Theme Volty CMS BrandList module for PrestaShop In the module “Theme Volty CMS BrandList” (tvcmsbrandlist) up to ve… |
CVE-2023-39649 | Critical | 9.8 | 2023-10-03 | Improper neutralization of SQL parameter in Theme Volty CMS Category Slider module for PrestaShop. In the module “Theme Volty CMS Category Slider” (tvcmscatego… |
CVE-2023-39648 | Critical | 9.8 | 2023-10-03 | Improper neutralization of SQL parameter in Theme Volty CMS Testimonial module for PrestaShop. In the module “Theme Volty CMS Testimonial” (tvcmstestimonial) u… |
CVE-2023-39646 | Critical | 9.8 | 2023-10-03 | Improper neutralization of SQL parameter in Theme Volty CMS Category Chain Slider module for PrestaShop. In the module “Theme Volty CMS Category Chain Slide"(t… |
CVE-2023-44974 | Critical | 9.8 | 2023-10-03 | An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2023-44973 | Critical | 9.8 | 2023-10-03 | An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a craf… |
CVE-2023-43953 | Medium | 5.4 | 2023-10-03 | SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Content Management component. |
CVE-2023-43952 | Medium | 5.4 | 2023-10-03 | SSCMS 7.2.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Material Management component. |
CVE-2023-43951 | Medium | 5.4 | 2023-10-03 | SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Column Management component. |
CVE-2023-43898 | Medium | 5.5 | 2023-10-03 | Nothings stb 2.28 was discovered to contain a Null Pointer Dereference via the function stbi__convert_format. This vulnerability allows attackers to cause a De… |
CVE-2023-43176 | High | 8.8 | 2023-10-03 | A deserialization vulnerability in Afterlogic Aurora Files v9.7.3 allows attackers to execute arbitrary code via supplying a crafted .sabredav file. |
CVE-2023-40519 | Medium | 6.1 | 2023-10-03 | A cross-site scripting (XSS) vulnerability in the bpk-common/auth/login/index.html login portal in Broadpeak Centralized Accounts Management Auth Agent 01.01.0… |
CVE-2023-39645 | Critical | 9.8 | 2023-10-03 | Improper neutralization of SQL parameter in Theme Volty CMS Payment Icon module for PrestaShop. In the module “Theme Volty CMS Payment Icon” (tvcmspaymenticon)… |
CVE-2023-33273 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the WGET check function is vulnerable to OS command injection (blind). |
CVE-2023-33272 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter ip within the Ping check function is vulnerable to OS command injection (blind). |
CVE-2023-33271 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter common_name within the SSL Certificate check function is vulnerable to OS command injection (bl… |
CVE-2023-33270 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the Curl check function is vulnerable to OS command injection (blind). |
CVE-2023-33269 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter options within the WGET check function is vulnerable to OS command injection (blind). |
CVE-2023-33268 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter port within the SSL Certificate check function is vulnerable to OS command injection (blind). |
CVE-2023-40830 | Critical | 9.8 | 2023-10-03 | Tenda AC6 v15.03.05.19 is vulnerable to Buffer Overflow as the Index parameter does not verify the length. |
CVE-2023-43976 | High | 8.1 | 2023-10-03 | An issue in CatoNetworks CatoClient before v.5.4.0 allows attackers to escalate privileges and winning the race condition (TOCTOU) via the PrivilegedHelperTool… |
CVE-2023-5255 | Medium | 4.4 | 2023-10-03 | For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked. |
CVE-2023-4911 | High | 7.8 | 2023-10-03 | A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a… |