2023 CVEs (page 147)
Page 147 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-39989 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in 99robots Header Footer Code Manager plugin <= 1.1.34 versions. |
CVE-2023-39923 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme The Post Grid plugin <= 7.2.7 versions. |
CVE-2023-39917 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin <= 5.2.6 versions. |
CVE-2023-39165 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Fetch Designs Sign-up Sheets plugin <= 2.2.8 versions. |
CVE-2023-2830 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Trustindex.Io WP Testimonials plugin <= 1.4.2 versions. |
CVE-2023-25989 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Play… |
CVE-2023-4097 | High | 8.8 | 2023-10-03 | The file upload functionality is not implemented correctly and allows uploading of any type of file. As a prerequisite, it is necessary for the attacker to log… |
CVE-2023-38398 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Taboola plugin <= 2.0.1 versions. |
CVE-2023-38396 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Alain Gonzalez plugin <= 3.1.2 versions. |
CVE-2023-38390 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Anshul Labs Mobile Address Bar Changer plugin <= 3.0 versions. |
CVE-2023-37990 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Mike Perelink Pro plugin <= 2.1.4 versions. |
CVE-2023-25463 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Gopi Ramasamy WP tell a friend popup form plugin <= 7.1 versions. |
CVE-2023-24518 | Medium | 6.7 | 2023-10-03 | A Cross-site Request Forgery (CSRF) vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they ar… |
CVE-2023-0828 | Medium | 6.7 | 2023-10-03 | Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers… |
CVE-2023-38381 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Cyle Conoly WP-FlyBox plugin <= 6.46 versions. |
CVE-2023-37998 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Saas Disabler allows Cross Site Request Forgery.This issue affects Disabler: from n/a through 3.0.3. |
CVE-2023-37996 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.7 versions. |
CVE-2023-37992 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions. |
CVE-2023-37991 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Monchito.Net WP Emoji One plugin <= 0.6.0 versions. |
CVE-2023-37891 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in OptiMonk OptiMonk: Popups, Personalization & A/B Testing plugin <= 2.0.4 versions. |
CVE-2023-3654 | Critical | 9.4 | 2023-10-03 | cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a origin bypass via the ho… |
CVE-2023-44218 | High | 8.8 | 2023-10-03 | A flaw within the SonicWall NetExtender Pre-Logon feature enables an unauthorized user to gain access to the host Windows operating system with 'SYSTEM' level… |
CVE-2023-44217 | High | 7.8 | 2023-10-03 | A local privilege escalation vulnerability in SonicWall Net Extender MSI client for Windows 10.2.336 and earlier versions allows a local low-privileged user t… |
CVE-2023-3656 | Critical | 9.8 | 2023-10-03 | cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote… |
CVE-2023-3655 | High | 7.5 | 2023-10-03 | cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a dangerous methods, that… |
CVE-2023-33039 | High | 8.4 | 2023-10-03 | Memory corruption in Automotive Display while destroying the image handle created using connected display driver. |
CVE-2023-33035 | High | 7.8 | 2023-10-03 | Memory corruption while invoking callback function of AFE from ADSP. |
CVE-2023-33034 | High | 7.8 | 2023-10-03 | Memory corruption while parsing the ADSP response command. |
CVE-2023-33029 | High | 8.4 | 2023-10-03 | Memory corruption in DSP Service during a remote call from HLOS to DSP. |
CVE-2023-33028 | Critical | 9.8 | 2023-10-03 | Memory corruption in WLAN Firmware while doing a memory copy of pmk cache. |
CVE-2023-33027 | High | 7.5 | 2023-10-03 | Transient DOS in WLAN Firmware while parsing rsn ies. |
CVE-2023-33026 | High | 7.5 | 2023-10-03 | Transient DOS in WLAN Firmware while parsing a NAN management frame. |
CVE-2023-28571 | Medium | 6.1 | 2023-10-03 | Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan. |
CVE-2023-28540 | Critical | 9.1 | 2023-10-03 | Cryptographic issue in Data Modem due to improper authentication during TLS handshake. |
CVE-2023-28539 | Medium | 6.6 | 2023-10-03 | Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command. |
CVE-2023-24855 | Critical | 9.8 | 2023-10-03 | Memory corruption in Modem while processing security related configuration before AS Security Exchange. |
CVE-2023-24853 | High | 8.4 | 2023-10-03 | Memory Corruption in HLOS while registering for key provisioning notify. |
CVE-2023-24850 | High | 7.8 | 2023-10-03 | Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application. |
CVE-2023-24849 | High | 8.2 | 2023-10-03 | Information Disclosure in data Modem while parsing an FMTP line in an SDP message. |
CVE-2023-24848 | High | 8.2 | 2023-10-03 | Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value. |
CVE-2023-24847 | High | 7.5 | 2023-10-03 | Transient DOS in Modem while allocating DSM items. |
CVE-2023-24844 | High | 8.4 | 2023-10-03 | Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range. |
CVE-2023-24843 | High | 7.5 | 2023-10-03 | Transient DOS in Modem while triggering a camping on an 5G cell. |
CVE-2023-22385 | High | 8.2 | 2023-10-03 | Memory Corruption in Data Modem while making a MO call or MT VOLTE call. |
CVE-2023-22384 | Medium | 6.7 | 2023-10-03 | Memory Corruption in VR Service while sending data using Fast Message Queue (FMQ). |
CVE-2023-22382 | High | 7.4 | 2023-10-03 | Weak configuration in Automotive while VM is processing a listener request from TEE. |
CVE-2023-21673 | High | 8.7 | 2023-10-03 | Improper Access to the VM resource manager can lead to Memory Corruption. |
CVE-2023-26152 | High | 7.5 | 2023-10-03 | All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath function of server… |
CVE-2023-26151 | Medium | 5.3 | 2023-10-03 | Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the… |
CVE-2023-26150 | Medium | 6.5 | 2023-10-03 | Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and… |
CVE-2023-5345 | High | 7.8 | 2023-10-03 | A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in sm… |
CVE-2023-5334 | Medium | 6.4 | 2023-10-03 | The WP Responsive header image slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sp_responsiveslider' shortcode in versions up to… |
CVE-2023-3967 | Medium | 5.3 | 2023-10-03 | Allocation of Resources Without Limits or Throttling vulnerability in Hitachi Ops Center Common Services on Linux allows DoS.This issue affects Hitachi Ops Cen… |
CVE-2023-3440 | High | 8.4 | 2023-10-03 | Incorrect Default Permissions vulnerability in Hitachi JP1/Performance Management on Windows allows File Manipulation.This issue affects JP1/Performance Manage… |
CVE-2023-3335 | Medium | 6.5 | 2023-10-03 | Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Administrator on Linux allows local users to gain sensitive information.T… |
CVE-2023-43627 | Medium | 5.7 | 2023-10-03 | Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent authenticate… |
CVE-2023-42771 | High | 8.8 | 2023-10-03 | Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unaut… |
CVE-2023-41086 | High | 8.8 | 2023-10-03 | Cross-site request forgery (CSRF) vulnerability exists in FURUNO SYSTEMS wireless LAN access point devices. If a user views a malicious page while logged in, u… |
CVE-2023-39429 | Medium | 5.4 | 2023-10-03 | Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary script via a crafted… |
CVE-2023-39222 | High | 8.8 | 2023-10-03 | OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is… |
CVE-2023-36628 | High | 8.8 | 2023-10-03 | A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation. |
CVE-2023-32572 | Medium | 6.5 | 2023-10-03 | A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup Safe… |
CVE-2023-28373 | Medium | 4.4 | 2023-10-03 | A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system incl… |
CVE-2023-43980 | Critical | 9.8 | 2023-10-02 | Presto Changeo testsitecreator up to v1.1.1 was discovered to contain a SQL injection vulnerability via the component disable_json.php. |
CVE-2023-36627 | High | 7.7 | 2023-10-02 | A flaw exists in FlashBlade Purity whereby a user with access to an administrative account on a FlashBlade that is configured with timezone-dependent snapshot… |
CVE-2023-31042 | High | 7.7 | 2023-10-02 | A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s… |
CVE-2023-28372 | Medium | 6.5 | 2023-10-02 | A flaw exists in FlashBlade Purity (OE) Version 4.1.0 whereby a user with privileges to extend an object’s retention period can affect the availability of the… |
CVE-2023-44012 | Medium | 6.1 | 2023-10-02 | Cross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the helpkey parameter in the Help.aspx compon… |
CVE-2023-44011 | Critical | 9.8 | 2023-10-02 | An issue in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the layout.master skin file at the Skin management… |
CVE-2023-43893 | Critical | 9.8 | 2023-10-02 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the wakeup_mac parameter in the Wake-On-LAN (WoL) function. This vulnera… |
CVE-2023-43892 | Critical | 9.8 | 2023-10-02 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the Hostname parameter within the WAN settings. This vulnerability is ex… |
CVE-2023-43891 | Critical | 9.8 | 2023-10-02 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Password function. This vulnerability is exploi… |
CVE-2023-44009 | Critical | 9.8 | 2023-10-02 | File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the Skin Management function. |
CVE-2023-44008 | Critical | 9.8 | 2023-10-02 | File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the File Manager function. |
CVE-2023-43836 | Medium | 6.5 | 2023-10-02 | There is a SQL injection vulnerability in the Jizhicms 2.4.9 backend, which users can use to obtain database information |
CVE-2023-43361 | High | 7.8 | 2023-10-02 | Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of… |
CVE-2023-43297 | Medium | 5.4 | 2023-10-02 | An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. |
CVE-2023-43268 | High | 8.8 | 2023-10-02 | Deyue Remote Vehicle Management System v1.1 was discovered to contain a deserialization vulnerability. |
CVE-2023-43267 | Medium | 5.4 | 2023-10-02 | A cross-site scripting (XSS) vulnerability in the publish article function of emlog pro v2.1.14 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2023-5344 | High | 7.5 | 2023-10-02 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969. |
CVE-2023-44463 | Medium | 5.3 | 2023-10-02 | An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers e… |
CVE-2023-43890 | High | 8.8 | 2023-10-02 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the diagnostic tools page. This vulnerability is exploited via a crafted… |
CVE-2023-43835 | High | 8.8 | 2023-10-02 | Super Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote Code Execution when settings overwrite c… |
CVE-2023-3592 | Medium | 5.8 | 2023-10-02 | In Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains invalid property types. |
CVE-2023-37605 | Medium | 5.5 | 2023-10-02 | Weak Exception Handling vulnerability in baramundi software GmbH EMM Agent 23.1.50 and before allows an attacker to cause a denial of service via a crafted req… |
CVE-2023-0809 | Medium | 5.8 | 2023-10-02 | In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets. |
CVE-2023-4659 | Critical | 9.8 | 2023-10-02 | Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply b… |
CVE-2023-3770 | Medium | 5.3 | 2023-10-02 | Incorrect validation vulnerability of the data entered, allowing an attacker with access to the network on which the affected device is located to use the di… |
CVE-2023-3769 | High | 8.6 | 2023-10-02 | Incorrect data input validation vulnerability, which could allow an attacker with access to the network to implement fuzzing techniques that would allow him to… |
CVE-2023-3744 | Critical | 9.9 | 2023-10-02 | Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send requests to internal service… |
CVE-2023-41580 | High | 7.5 | 2023-10-02 | Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php. This vulnerability allow… |
CVE-2023-5106 | High | 8.2 | 2023-10-02 | An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to… |
CVE-2023-5160 | Medium | 4.3 | 2023-10-02 | Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint allowing a member to get the full name of another us… |
CVE-2023-44266 | Medium | 5.9 | 2023-10-02 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jewel Theme WP Adminify plugin <= 3.1.6 versions. |
CVE-2023-44265 | Medium | 5.9 | 2023-10-02 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Popup contact form plugin <= 7.1 versions. |
CVE-2023-44264 | Medium | 6.5 | 2023-10-02 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin <= 2.2.5 versions. |
CVE-2023-44242 | Medium | 6.5 | 2023-10-02 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in 2J Slideshow Team Slideshow, Image Slider by 2J plugin <= 1.3.54 versions. |
CVE-2023-44230 | Medium | 5.9 | 2023-10-02 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Popup contact form plugin <= 7.1 versions. |
CVE-2023-44228 | Medium | 5.9 | 2023-10-02 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Onclick show popup plugin <= 8.1 versions. |
CVE-2023-3768 | High | 8.6 | 2023-10-02 | Incorrect data input validation vulnerability, which could allow an attacker with access to the network to implement fuzzing techniques that would allow him to… |