2023 CVEs (page 146)
Page 146 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37995 | Medium | 4.3 | 2023-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions. |
CVE-2023-2809 | High | 7.8 | 2023-10-04 | Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQL database… |
CVE-2023-2422 | Medium | 5.5 | 2023-10-04 | A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certific… |
CVE-2023-25980 | Medium | 4.3 | 2023-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in CAGE Web Design | Rolf van Gelder Optimize Database after Deleting Revisions plugin <= 5.1 versions. |
CVE-2023-25788 | Medium | 6.3 | 2023-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in Saphali Saphali Woocommerce Lite plugin <= 1.8.13 versions. |
CVE-2023-25489 | Medium | 4.3 | 2023-10-04 | Cross-Site Request Forgery (CSRF) vulnerability in Jeff Sherk Update Theme and Plugins from Zip File plugin <= 2.0.0 versions. |
CVE-2023-1584 | High | 7.5 | 2023-10-04 | A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can a… |
CVE-2023-5377 | High | 7.1 | 2023-10-04 | Out-of-bounds Read in GitHub repository gpac/gpac prior to v2.2.2-DEV. |
CVE-2023-5375 | Medium | 6.1 | 2023-10-04 | Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2. |
CVE-2023-44272 | Medium | 5.4 | 2023-10-04 | A cross-site scripting vulnerability exists in Citadel versions prior to 994. When a malicious user sends an instant message with some JavaScript code, the scr… |
CVE-2023-5370 | Medium | 5.5 | 2023-10-04 | On CPU 0 the check for the SMCCC workaround is called before SMCCC support has been initialized. This resulted in no speculative execution workarounds being in… |
CVE-2023-5369 | High | 7.1 | 2023-10-04 | Before correction, the copy_file_range system call checked only for the CAP_READ and CAP_WRITE capabilities on the input and output file descriptors, respectiv… |
CVE-2023-5368 | Medium | 6.5 | 2023-10-04 | On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances populate the additional space in the file with unallocated dat… |
CVE-2023-30738 | Medium | 5.5 | 2023-10-04 | An improper input validation in UEFI Firmware prior to Firmware update Oct-2023 Release in Galaxy Book, Galaxy Book Pro, Galaxy Book Pro 360 and Galaxy Book Od… |
CVE-2023-30737 | Medium | 4.0 | 2023-10-04 | Improper access control vulnerability in Samsung Health prior to version 6.24.3.007 allows attackers to access sensitive information via implicit intent. |
CVE-2023-30736 | Medium | 4.4 | 2023-10-04 | Improper authorization in PushMsgReceiver of Samsung Assistant prior to version 8.7.00.1 allows attacker to execute javascript interface. To trigger this vulne… |
CVE-2023-30735 | Medium | 5.1 | 2023-10-04 | Improper Preservation of Permissions vulnerability in SAssistant prior to version 8.7 allows local attackers to access backup data in SAssistant. |
CVE-2023-30734 | Medium | 4.0 | 2023-10-04 | Improper access control vulnerability in Samsung Health prior to version 6.24.3.007 allows attackers to access sensitive information via implicit intent. |
CVE-2023-30733 | High | 7.8 | 2023-10-04 | Stack-based Buffer Overflow in vulnerability HDCP trustlet prior to SMR Oct-2023 Release 1 allows local privileged attackers to perform code execution. |
CVE-2023-30732 | Medium | 5.5 | 2023-10-04 | Improper access control in system property prior to SMR Oct-2023 Release 1 allows local attacker to get CPU serial number. |
CVE-2023-30731 | Medium | 5.7 | 2023-10-04 | Logic error in package installation via debugger command prior to SMR Oct-2023 Release 1 allows physical attacker to install an application that has different… |
CVE-2023-30727 | Medium | 6.7 | 2023-10-04 | Improper access control vulnerability in SecSettings prior to SMR Oct-2023 Release 1 allows attackers to enable Wi-Fi and connect arbitrary Wi-Fi without User… |
CVE-2023-30692 | High | 8.5 | 2023-10-04 | Improper input validation vulnerability in Evaluator prior to SMR Oct-2023 Release 1 allows local attackers to launch privileged activities. |
CVE-2023-30690 | High | 8.5 | 2023-10-04 | Improper input validation vulnerability in Duo prior to SMR Oct-2023 Release 1 allows local attackers to launch privileged activities. |
CVE-2023-5357 | Medium | 6.4 | 2023-10-04 | The Instagram for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.6 due to ins… |
CVE-2023-5291 | Medium | 6.4 | 2023-10-04 | The Blog Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'AWL-BlogFilter' shortcode in versions up to, and including, 1.5.3 due to… |
CVE-2023-3213 | Medium | 5.3 | 2023-10-04 | The WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_print_page function in versi… |
CVE-2023-37404 | Medium | 6.4 | 2023-10-04 | IBM Observability with Instana 1.0.243 through 1.0.254 could allow an attacker on the network to execute arbitrary code on the host after a successful DNS pois… |
CVE-2023-35905 | Medium | 4.6 | 2023-10-04 | IBM FileNet Content Manager 5.5.8, 5.5.10, and 5.5.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2023-39647 | Critical | 9.8 | 2023-10-03 | Improper neutralization of SQL parameter in Theme Volty CMS Category Product module for PrestaShop. In the module “Theme Volty CMS Category Product” (tvcmscate… |
CVE-2023-39651 | Critical | 9.8 | 2023-10-03 | Improper neutralization of SQL parameter in Theme Volty CMS BrandList module for PrestaShop In the module “Theme Volty CMS BrandList” (tvcmsbrandlist) up to ve… |
CVE-2023-39649 | Critical | 9.8 | 2023-10-03 | Improper neutralization of SQL parameter in Theme Volty CMS Category Slider module for PrestaShop. In the module “Theme Volty CMS Category Slider” (tvcmscatego… |
CVE-2023-39648 | Critical | 9.8 | 2023-10-03 | Improper neutralization of SQL parameter in Theme Volty CMS Testimonial module for PrestaShop. In the module “Theme Volty CMS Testimonial” (tvcmstestimonial) u… |
CVE-2023-39646 | Critical | 9.8 | 2023-10-03 | Improper neutralization of SQL parameter in Theme Volty CMS Category Chain Slider module for PrestaShop. In the module “Theme Volty CMS Category Chain Slide"(t… |
CVE-2023-44974 | Critical | 9.8 | 2023-10-03 | An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2023-44973 | Critical | 9.8 | 2023-10-03 | An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a craf… |
CVE-2023-43953 | Medium | 5.4 | 2023-10-03 | SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Content Management component. |
CVE-2023-43952 | Medium | 5.4 | 2023-10-03 | SSCMS 7.2.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Material Management component. |
CVE-2023-43951 | Medium | 5.4 | 2023-10-03 | SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Column Management component. |
CVE-2023-43898 | Medium | 5.5 | 2023-10-03 | Nothings stb 2.28 was discovered to contain a Null Pointer Dereference via the function stbi__convert_format. This vulnerability allows attackers to cause a De… |
CVE-2023-43176 | High | 8.8 | 2023-10-03 | A deserialization vulnerability in Afterlogic Aurora Files v9.7.3 allows attackers to execute arbitrary code via supplying a crafted .sabredav file. |
CVE-2023-40519 | Medium | 6.1 | 2023-10-03 | A cross-site scripting (XSS) vulnerability in the bpk-common/auth/login/index.html login portal in Broadpeak Centralized Accounts Management Auth Agent 01.01.0… |
CVE-2023-39645 | Critical | 9.8 | 2023-10-03 | Improper neutralization of SQL parameter in Theme Volty CMS Payment Icon module for PrestaShop. In the module “Theme Volty CMS Payment Icon” (tvcmspaymenticon)… |
CVE-2023-33273 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the WGET check function is vulnerable to OS command injection (blind). |
CVE-2023-33272 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter ip within the Ping check function is vulnerable to OS command injection (blind). |
CVE-2023-33271 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter common_name within the SSL Certificate check function is vulnerable to OS command injection (bl… |
CVE-2023-33270 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the Curl check function is vulnerable to OS command injection (blind). |
CVE-2023-33269 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter options within the WGET check function is vulnerable to OS command injection (blind). |
CVE-2023-33268 | Critical | 9.8 | 2023-10-03 | An issue was discovered in DTS Monitoring 3.57.0. The parameter port within the SSL Certificate check function is vulnerable to OS command injection (blind). |
CVE-2023-40830 | Critical | 9.8 | 2023-10-03 | Tenda AC6 v15.03.05.19 is vulnerable to Buffer Overflow as the Index parameter does not verify the length. |
CVE-2023-43976 | High | 8.1 | 2023-10-03 | An issue in CatoNetworks CatoClient before v.5.4.0 allows attackers to escalate privileges and winning the race condition (TOCTOU) via the PrivilegedHelperTool… |
CVE-2023-5255 | Medium | 4.4 | 2023-10-03 | For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked. |
CVE-2023-4911 | High | 7.8 | 2023-10-03 | A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a… |
CVE-2023-4732 | Medium | 4.7 | 2023-10-03 | A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause… |
CVE-2023-34970 | Medium | 4.7 | 2023-10-03 | A local non-privileged user can make improper GPU processing operations to access a limited amount outside of buffer bounds or to exploit a software race condi… |
CVE-2023-33200 | Medium | 4.7 | 2023-10-03 | A local non-privileged user can make improper GPU processing operations to exploit a software race condition. If the system’s memory is carefully prepared by t… |
CVE-2023-4817 | High | 7.2 | 2023-10-03 | This vulnerability allows an authenticated attacker to upload malicious files by bypassing the restrictions of the upload functionality, compromising the entir… |
CVE-2023-4564 | Medium | 4.7 | 2023-10-03 | This vulnerability could allow an attacker to store a malicious JavaScript payload in the broadcast message parameter within the admin panel. |
CVE-2023-3196 | Medium | 4.7 | 2023-10-03 | This vulnerability could allow an attacker to store a malicious JavaScript payload in the login footer and login page description parameters within the adminis… |
CVE-2023-4886 | Medium | 6.7 | 2023-10-03 | A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and… |
CVE-2023-4885 | Medium | 6.5 | 2023-10-03 | Man in the Middle vulnerability, which could allow an attacker to intercept VNF (Virtual Network Function) communications resulting in the exposure of sensitiv… |
CVE-2023-4884 | Medium | 6.5 | 2023-10-03 | An attacker could send an HTTP request to an Open5GS endpoint and retrieve the information stored on the device due to the lack of Authentication. |
CVE-2023-4883 | High | 7.5 | 2023-10-03 | Invalid pointer release vulnerability. Exploitation of this vulnerability could allow an attacker to interrupt the correct operation of the service by sending… |
CVE-2023-4882 | High | 7.5 | 2023-10-03 | DOS vulnerability that could allow an attacker to register a new VNF (Virtual Network Function) value. This action could trigger the args_assets() function def… |
CVE-2023-4929 | Medium | 6.5 | 2023-10-03 | All firmware versions of the NPort 5000 Series are affected by an improper validation of integrity check vulnerability. This vulnerability results from insuffi… |
CVE-2023-41693 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in edward_plainview MyCryptoCheckout plugin <= 2.125 versions. |
CVE-2023-41244 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Buildfail Localize Remote Images plugin <= 1.0.9 versions. |
CVE-2023-40558 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in eMarket Design YouTube Video Gallery by YouTube Showcase plugin <= 3.3.5 versions. |
CVE-2023-3350 | High | 8.2 | 2023-10-03 | A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attacker could retrieve t… |
CVE-2023-3349 | High | 8.2 | 2023-10-03 | Information exposure vulnerability in IBERMATICA RPS 2019, which exploitation could allow an unauthenticated user to retrieve sensitive information, such as us… |
CVE-2023-39158 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Banner Management For WooCommerce plugin <= 2.4.2 versions. |
CVE-2023-32091 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in POEditor plugin <= 0.9.4 versions. |
CVE-2023-2544 | Medium | 5.3 | 2023-10-03 | Authorization bypass vulnerability in UPV PEIX, affecting the component "pdf_curri_new.php". Through a POST request, an authenticated user could change the ID… |
CVE-2023-27435 | Medium | 6.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Sami Ahmed Siddiqui HTTP Auth plugin <= 0.3.2 versions. |
CVE-2023-0506 | High | 8.8 | 2023-10-03 | The web service of ByDemes Group Airspace CCTV Web Service in its 2.616.BY00.11 version, contains a privilege escalation vulnerability, detected in the Camera… |
CVE-2023-5353 | Medium | 6.5 | 2023-10-03 | Improper Access Control in GitHub repository salesagility/suitecrm prior to 7.14.1. |
CVE-2023-42508 | Medium | 6.5 | 2023-10-03 | JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users be… |
CVE-2023-40212 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Product Attachment for WooCommerce plugin <= 2.1.8 versions. |
CVE-2023-40202 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Hannes Etzelstorfer // codemiq WP HTML Mail plugin <= 3.4.1 versions. |
CVE-2023-40201 | Medium | 6.5 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in FuturioWP Futurio Extra plugin <= 1.8.4 versions leads to activation of arbitrary plugin. |
CVE-2023-40199 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab WP Like Button plugin <= 1.7.0 versions. |
CVE-2023-40198 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Antsanchez Easy Cookie Law plugin <= 3.1 versions. |
CVE-2023-40009 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Pipes plugin <= 1.4.0 versions. |
CVE-2023-39159 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Fraud Prevention For Woocommerce plugin <= 2.1.5 versions. |
CVE-2023-32792 | Medium | 6.5 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to eliminate roles within the platform… |
CVE-2023-32791 | Medium | 6.5 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to manipulate and delete user accounts… |
CVE-2023-32790 | Medium | 4.6 | 2023-10-03 | Cross-Site Scripting (XSS) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to inject a malicious JavaScript payload into… |
CVE-2023-32671 | Medium | 6.3 | 2023-10-03 | A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9. This vulnerability allows an attacker to store a malicious javascript… |
CVE-2023-32670 | Critical | 9.0 | 2023-10-03 | Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 version , which could allow a local attacker with basic privileges to execute a malicious payload thro… |
CVE-2023-32669 | Medium | 5.4 | 2023-10-03 | Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' al… |
CVE-2023-2681 | High | 8.8 | 2023-10-03 | An SQL Injection vulnerability has been found on Jorani version 1.0.0. This vulnerability allows an authenticated remote user, with low privileges, to send que… |
CVE-2023-5351 | Medium | 5.4 | 2023-10-03 | Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm prior to 7.14.1. |
CVE-2023-5350 | Critical | 9.1 | 2023-10-03 | SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1. |
CVE-2023-4103 | High | 8.8 | 2023-10-03 | QSige statistics are affected by a remote SQLi vulnerability. It has been identified that the web application does not correctly filter input parameters, allow… |
CVE-2023-4102 | High | 8.8 | 2023-10-03 | QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisi… |
CVE-2023-4101 | High | 8.8 | 2023-10-03 | The QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prereq… |
CVE-2023-4100 | Medium | 6.5 | 2023-10-03 | Allows an attacker to perform XSS attacks stored on certain resources. Exploiting this vulnerability can lead to a DoS condition, among other actions. |
CVE-2023-4099 | High | 7.6 | 2023-10-03 | The QSige Monitor application does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. A… |
CVE-2023-4098 | High | 8.8 | 2023-10-03 | It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prereq… |
CVE-2023-40210 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Sean Barton (Tortoise IT) SB Child List plugin <= 4.5 versions. |