2023 CVEs (page 149)
Page 149 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5227 | Critical | 9.8 | 2023-09-30 | Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8. |
CVE-2023-5297 | Low | 3.7 | 2023-09-29 | A vulnerability was found in Xinhu RockOA 2.3.2. It has been classified as problematic. This affects the function start of the file task.php?m=sys|runt&a=beife… |
CVE-2023-5296 | Medium | 4.3 | 2023-09-29 | A vulnerability was found in Xinhu RockOA 1.1/2.3.2/15.X3amdi and classified as problematic. Affected by this issue is some unknown functionality of the file a… |
CVE-2023-5294 | Medium | 4.7 | 2023-09-29 | A vulnerability has been found in ECshop 4.1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/order… |
CVE-2023-44270 | Medium | 5.3 | 2023-09-29 | An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS… |
CVE-2023-5293 | Medium | 4.7 | 2023-09-29 | A vulnerability, which was classified as critical, was found in ECshop 4.1.5. Affected is an unknown function of the file /admin/leancloud.php. The manipulatio… |
CVE-2023-5287 | Low | 2.4 | 2023-09-29 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in BEECMS 4.0. This affects an unknown part of the file /admin/… |
CVE-2023-5286 | Low | 3.5 | 2023-09-29 | A vulnerability, which was classified as problematic, has been found in SourceCodester Expense Tracker App v1. Affected by this issue is some unknown functiona… |
CVE-2023-5285 | Medium | 6.3 | 2023-09-29 | A vulnerability classified as critical was found in Tongda OA 2017. Affected by this vulnerability is an unknown functionality of the file general/hr/recruit/r… |
CVE-2023-5284 | Medium | 6.3 | 2023-09-29 | A vulnerability classified as critical has been found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file upload_save_st… |
CVE-2023-5283 | Medium | 6.3 | 2023-09-29 | A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2023-43655 | Medium | 6.4 | 2023-09-29 | Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php f… |
CVE-2023-5282 | Medium | 6.3 | 2023-09-29 | A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2023-5281 | Medium | 6.3 | 2023-09-29 | A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been classified as critical. This affects an unknown part of the file remove_in… |
CVE-2023-5280 | Medium | 6.3 | 2023-09-29 | A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2023-5279 | Medium | 6.3 | 2023-09-29 | A vulnerability has been found in SourceCodester Engineers Online Portal 1.0 and classified as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2023-5278 | Medium | 6.3 | 2023-09-29 | A vulnerability, which was classified as critical, was found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file login.p… |
CVE-2023-5277 | Medium | 6.3 | 2023-09-29 | A vulnerability, which was classified as critical, has been found in SourceCodester Engineers Online Portal 1.0. This issue affects some unknown processing of… |
CVE-2023-5276 | Medium | 6.3 | 2023-09-29 | A vulnerability classified as critical was found in SourceCodester Engineers Online Portal 1.0. This vulnerability affects unknown code of the file downloadabl… |
CVE-2023-26218 | High | 8.0 | 2023-09-29 | The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a lo… |
CVE-2023-5273 | Low | 3.5 | 2023-09-29 | A vulnerability classified as problematic was found in SourceCodester Best Courier Management System 1.0. This vulnerability affects unknown code of the file m… |
CVE-2023-5272 | Medium | 5.5 | 2023-09-29 | A vulnerability classified as critical has been found in SourceCodester Best Courier Management System 1.0. This affects an unknown part of the file edit_parce… |
CVE-2023-3024 | Medium | 5.9 | 2023-09-29 | Forcing the Bluetooth LE stack to segment 'prepare write response' packets can lead to an out-of-bounds memory access. |
CVE-2023-39410 | High | 7.5 | 2023-09-29 | When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on… |
CVE-2023-5271 | Medium | 5.5 | 2023-09-29 | A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functiona… |
CVE-2023-5270 | Medium | 5.5 | 2023-09-29 | A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2023-5269 | Medium | 5.5 | 2023-09-29 | A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been classified as critical. Affected is an unknown function of the file… |
CVE-2023-5268 | Medium | 6.3 | 2023-09-29 | A vulnerability was found in DedeBIZ 6.2 and classified as critical. This issue affects some unknown processing of the file /src/admin/makehtml_taglist_action… |
CVE-2023-5267 | Medium | 5.5 | 2023-09-29 | A vulnerability has been found in Tongda OA 2017 and classified as critical. This vulnerability affects unknown code of the file general/hr/recruit/hr_pool/del… |
CVE-2023-5266 | Medium | 6.3 | 2023-09-29 | A vulnerability, which was classified as critical, was found in DedeBIZ 6.2. This affects an unknown part of the file /src/admin/tags_main.php. The manipulatio… |
CVE-2023-5265 | Medium | 5.5 | 2023-09-29 | A vulnerability, which was classified as critical, has been found in Tongda OA 2017. Affected by this issue is some unknown functionality of the file general/h… |
CVE-2023-5264 | Medium | 6.3 | 2023-09-29 | A vulnerability classified as critical was found in huakecms 3.0. Affected by this vulnerability is an unknown functionality of the file /admin/cms_content.php… |
CVE-2023-5289 | High | 8.8 | 2023-09-29 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.4. |
CVE-2023-5263 | Medium | 6.3 | 2023-09-29 | A vulnerability was found in ZZZCMS 2.1.7 and classified as critical. Affected by this issue is the function restore of the file /admin/save.php of the compone… |
CVE-2023-5262 | Medium | 6.3 | 2023-09-29 | A vulnerability has been found in OpenRapid RapidCMS 1.3.1 and classified as critical. Affected by this vulnerability is the function isImg of the file /admin/… |
CVE-2023-41691 | High | 7.1 | 2023-09-29 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Pensopay WooCommerce PensoPay plugin <= 6.3.1 versions. |
CVE-2023-41687 | Medium | 6.5 | 2023-09-29 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Irina Sokolovskaya Goods Catalog plugin <= 2.4.1 versions. |
CVE-2023-41666 | Medium | 6.5 | 2023-09-29 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Stockdio Stock Quotes List plugin <= 2.9.9 versions. |
CVE-2023-41663 | High | 7.1 | 2023-09-29 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Giovambattista Fazioli WP Bannerize Pro plugin <= 1.6.9 versions. |
CVE-2023-41662 | High | 7.1 | 2023-09-29 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ulf Benjaminsson WP-dTree plugin <= 4.4.5 versions. |
CVE-2023-41661 | Medium | 5.9 | 2023-09-29 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions. |
CVE-2023-41658 | High | 7.1 | 2023-09-29 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Photo Gallery Slideshow & Masonry Tiled Gallery plugin <= 1.0.13 versions. |
CVE-2023-41657 | Medium | 5.9 | 2023-09-29 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Groundhogg Inc. HollerBox plugin <= 2.3.2 versions. |
CVE-2023-41655 | Medium | 5.9 | 2023-09-29 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Andreas Heigl authLdap plugin <= 2.5.9 versions. |
CVE-2023-39308 | High | 7.1 | 2023-09-29 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in UserFeedback Team User Feedback plugin <= 1.0.7 versions. |
CVE-2023-43944 | Medium | 5.4 | 2023-09-29 | A Stored Cross Site Scripting (XSS) vulnerability was found in SourceCodester Task Management System 1.0. It allows attackers to execute arbitrary code via par… |
CVE-2023-43909 | Critical | 9.1 | 2023-09-29 | Hospital Management System thru commit 4770d was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsearch.php. |
CVE-2023-5288 | Critical | 9.8 | 2023-09-29 | A remote unauthorized attacker may connect to the SIM1012, interact with the device and change configuration settings. The adversary may also reset the SIM an… |
CVE-2023-5261 | Medium | 5.5 | 2023-09-29 | A vulnerability, which was classified as critical, was found in Tongda OA 2017. Affected is an unknown function of the file general/hr/manage/staff_title_evalu… |
CVE-2023-5260 | Medium | 6.3 | 2023-09-29 | A vulnerability, which was classified as critical, has been found in SourceCodester Simple Membership System 1.0. This issue affects some unknown processing of… |
CVE-2023-5259 | Low | 2.7 | 2023-09-29 | A vulnerability classified as problematic was found in ForU CMS. This vulnerability affects unknown code of the file /admin/cms_admin.php. The manipulation of… |
CVE-2023-5258 | Medium | 6.3 | 2023-09-29 | A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file /resource/addgood.php. The manipula… |
CVE-2023-5257 | Low | 3.5 | 2023-09-29 | A vulnerability was found in WhiteHSBG JNDIExploit 1.4 on Windows. It has been rated as problematic. Affected by this issue is the function handleFileRequest o… |
CVE-2023-5196 | Medium | 6.5 | 2023-09-29 | Mattermost fails to enforce character limits in all possible notification props allowing an attacker to send a really long value for a notification_prop result… |
CVE-2023-5195 | Medium | 6.5 | 2023-09-29 | Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of |
CVE-2023-5194 | Low | 2.7 | 2023-09-29 | Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manag… |
CVE-2023-5193 | Medium | 4.9 | 2023-09-29 | Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a… |
CVE-2023-5159 | Low | 3.8 | 2023-09-29 | Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots… |
CVE-2023-3413 | Medium | 6.5 | 2023-09-29 | An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions sta… |
CVE-2023-5198 | Medium | 4.3 | 2023-09-29 | An issue has been discovered in GitLab affecting all versions prior to 16.2.7, all versions starting from 16.3 before 16.3.5, and all versions starting from 16… |
CVE-2023-3922 | Low | 3.0 | 2023-09-29 | An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions sta… |
CVE-2023-32477 | High | 7.8 | 2023-09-29 | Dell Common Event Enabler 8.9.8.2 for Windows and prior, contain an improper access control vulnerability. A local low-privileged malicious user may potential… |
CVE-2023-4532 | Medium | 4.3 | 2023-09-29 | An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions sta… |
CVE-2023-44469 | Medium | 4.3 | 2023-09-29 | A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to a… |
CVE-2023-3979 | Low | 3.1 | 2023-09-29 | An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions sta… |
CVE-2023-3920 | Medium | 4.3 | 2023-09-29 | An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions sta… |
CVE-2023-3917 | Medium | 4.3 | 2023-09-29 | Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to ca… |
CVE-2023-3914 | Medium | 5.4 | 2023-09-29 | A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects… |
CVE-2023-3906 | Low | 3.5 | 2023-09-29 | An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, al… |
CVE-2023-3115 | Medium | 5.4 | 2023-09-29 | An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16… |
CVE-2023-2233 | Low | 3.1 | 2023-09-29 | An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.2.8, all versions starting from 16.3 be… |
CVE-2023-0989 | Medium | 4.3 | 2023-09-29 | An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allo… |
CVE-2023-44466 | High | 8.8 | 2023-09-29 | An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5. There is an integer signedness error, leading to a buffer overflow and rem… |
CVE-2023-30591 | High | 7.5 | 2023-09-29 | Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, w… |
CVE-2023-44464 | High | 7.8 | 2023-09-29 | pretix before 2023.7.2 allows Pillow to parse EPS files. |
CVE-2023-26148 | Medium | 5.4 | 2023-09-29 | All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r… |
CVE-2023-26147 | Medium | 5.3 | 2023-09-29 | All versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers values. An attacker can… |
CVE-2023-26146 | Medium | 6.1 | 2023-09-29 | All versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name containing a malicious payload is serv… |
CVE-2023-5077 | High | 7.6 | 2023-09-29 | The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets… |
CVE-2023-3775 | Medium | 4.2 | 2023-09-29 | A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in… |
CVE-2023-43654 | Critical | 10.0 | 2023-09-28 | TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parti… |
CVE-2023-44174 | Medium | 6.4 | 2023-09-28 | Online Movie Ticket Booking System v1.0 is vulnerable to an authenticated Stored Cross-Site Scripting vulnerability. |
CVE-2023-44166 | Critical | 9.8 | 2023-09-28 | The 'age' parameter of the process_registration.php resource does not validate the characters received and they are sent unfiltered to the database. |
CVE-2023-44164 | Critical | 9.8 | 2023-09-28 | The 'Email' parameter of the process_login.php resource does not validate the characters received and they are sent unfiltered to the database. |
CVE-2023-44163 | Critical | 9.8 | 2023-09-28 | The 'search' parameter of the process_search.php resource does not validate the characters received and they are sent unfiltered to the database. |
CVE-2023-43739 | Critical | 9.8 | 2023-09-28 | The 'bookisbn' parameter of the cart.php resource does not validate the characters received and they are sent unfiltered to the database. |
CVE-2023-43662 | High | 8.6 | 2023-09-28 | ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endpoint is accessible without authenticati… |
CVE-2023-43014 | High | 8.8 | 2023-09-28 | Asset Management System v1.0 is vulnerable to an Authenticated SQL Injection vulnerability on the 'first_name' and 'last_name' parameters of user.php page… |
CVE-2023-5185 | Critical | 9.1 | 2023-09-28 | Gym Management System Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'file' parameter of profile/i.php page, allowing an authent… |
CVE-2023-5053 | Critical | 9.8 | 2023-09-28 | Hospital management system version 378c157 allows to bypass authentication. This is possible because the application is vulnerable to SQLI. |
CVE-2023-5004 | Critical | 9.8 | 2023-09-28 | Hospital management system version 378c157 allows to bypass authentication. This is possible because the application is vulnerable to SQLI. |
CVE-2023-4316 | High | 7.5 | 2023-09-28 | Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails. |
CVE-2023-44173 | Medium | 5.4 | 2023-09-28 | Online Movie Ticket Booking System v1.0 is vulnerable to an authenticated Reflected Cross-Site Scripting vulnerability. |
CVE-2023-43740 | High | 8.8 | 2023-09-28 | Online Book Store Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'image' parameter of admin_edit.php page, allowing an authenticate… |
CVE-2023-43013 | Critical | 9.8 | 2023-09-28 | Asset Management System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'email' parameter of index.php page, allowing an externa… |
CVE-2023-41911 | Medium | 4.7 | 2023-09-28 | Samsung Mobile Processor Exynos 2200 allows a GPU Double Free (issue 1 of 2). |
CVE-2023-43323 | Medium | 6.5 | 2023-09-28 | mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The… |
CVE-2023-43226 | High | 8.8 | 2023-09-28 | An arbitrary file upload vulnerability in dede/baidunews.php in DedeCMS 5.7.111 and earlier allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2023-5256 | High | 7.5 | 2023-09-28 | In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and ma… |
CVE-2023-43664 | Medium | 4.3 | 2023-09-28 | PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: m… |