2023 CVEs (page 15)
Page 15 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-43039 | Medium | 6.1 | 2025-07-08 | IBM OpenPages with Watson 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2023-52236 | High | 7.0 | 2025-07-08 | A vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (All versions), RUGGEDCOM i803 (All version… |
CVE-2023-51232 | High | 7.5 | 2025-07-07 | Directory Traversal vulnerability in dagster-webserver Dagster thru 1.5.11 allows remote attackers to obtain sensitive information via crafted request to the /… |
CVE-2023-50786 | Medium | 4.1 | 2025-07-05 | Dradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of forcing the use of embedded (uploaded) images. This can be leverage… |
CVE-2023-47310 | Medium | 6.5 | 2025-06-30 | A misconfiguration in the default settings of MikroTik RouterOS 7 and fixed in v7.14 allows incoming IPv6 UDP traceroute packets. |
CVE-2023-29113 | Medium | 6.3 | 2025-06-28 | The MIB3 infotainment unit used in Skoda and Volkswagen vehicles does not incorporate any privilege separation for the proprietary inter-process communication… |
CVE-2023-28912 | Medium | 5.7 | 2025-06-28 | The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the system or physical acc… |
CVE-2023-28911 | Medium | 6.5 | 2025-06-28 | A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-supplied data, which c… |
CVE-2023-28910 | High | 8.0 | 2025-06-28 | A specific flaw exists within the Bluetooth stack of the MIB3 infotainment system. The issue results from the disabled abortion flag eventually leading to bypa… |
CVE-2023-28909 | High | 8.0 | 2025-06-28 | A specific flaw exists within the Bluetooth stack of the MIB3 unit. The issue results from the lack of proper validation of user-supplied data, which can resul… |
CVE-2023-28908 | Medium | 5.4 | 2025-06-28 | A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-supplied data, which c… |
CVE-2023-28907 | Medium | 6.7 | 2025-06-28 | There is no memory isolation between CPU cores of the MIB3 infotainment. This fact allows an attacker with access to the main operating system to compromise th… |
CVE-2023-28906 | High | 7.8 | 2025-06-28 | A command injection in the networking service of the MIB3 infotainment allows an attacker already presenting in the system to escalate privileges and obtain ad… |
CVE-2023-28905 | High | 8.0 | 2025-06-28 | A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it. The vulnerability was o… |
CVE-2023-28904 | Medium | 5.2 | 2025-06-28 | A logic flaw leading to a RAM buffer overflow in the bootloader component of the MIB3 infotainment unit allows an attacker with physical access to the MIB3 ECU… |
CVE-2023-28903 | Low | 3.3 | 2025-06-28 | An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause a denial-of-servi… |
CVE-2023-28902 | Low | 3.3 | 2025-06-28 | An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause denial-of-servic… |
CVE-2023-38007 | Medium | 5.4 | 2025-06-27 | IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Power and 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.4.0, 2.3.4.1 on Intel operating systems is vulnera… |
CVE-2023-25998 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Samex - Clean, Minimal Shop W… |
CVE-2023-44915 | High | 7.1 | 2025-06-25 | A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a cr… |
CVE-2023-47030 | Critical | 9.8 | 2025-06-23 | An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via a GET request to a UserService… |
CVE-2023-47029 | Critical | 9.8 | 2025-06-23 | An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted POST request to the… |
CVE-2023-47031 | Critical | 9.8 | 2025-06-23 | An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to escalate privileges via a crafted POST request to the grantRolesToUsers, grantRolesToGroup… |
CVE-2023-50450 | High | 8.4 | 2025-06-23 | An issue was discovered in Sensopart VISOR Vision Sensors before 2.10.0.2 allows local users to perform unspecified actions with elevated privileges. |
CVE-2023-47295 | Critical | 9.8 | 2025-06-23 | A CSV injection vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands via injecting a crafted payload into any text field… |
CVE-2023-47294 | High | 8.1 | 2025-06-23 | An issue in NCR Terminal Handler v1.5.1 allows low-level privileged authenticated attackers to arbitrarily deactivate, lock, and delete user accounts via a cra… |
CVE-2023-47032 | Critical | 9.8 | 2025-06-23 | Password Vulnerability in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the UserService SOAP API func… |
CVE-2023-48978 | Critical | 9.8 | 2025-06-23 | An issue in NCR ITM Web terminal v.4.4.0 and v.4.4.4 allows a remote attacker to execute arbitrary code via a crafted script to the IP camera URL component. |
CVE-2023-47298 | Medium | 4.3 | 2025-06-23 | An issue in NCR Terminal Handler 1.5.1 allows a low-level privileged authenticated attacker to query the SOAP API endpoint to obtain information about all of t… |
CVE-2023-47297 | Critical | 9.8 | 2025-06-23 | A settings manipulation vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands, including editing system security auditing… |
CVE-2023-5600 | Low | 3.1 | 2025-06-20 | An issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions… |
CVE-2023-45256 | Medium | 5.4 | 2025-06-12 | Multiple SQL injection vulnerabilities in the EuroInformation MoneticoPaiement module before 1.1.1 for PrestaShop allow remote attackers to execute arbitrary S… |
CVE-2023-48786 | Medium | 4.3 | 2025-06-10 | A server-side request forgery vulnerability [CWE-918] in Fortinet FortiClientEMS version 7.4.0 through 7.4.2 and before 7.2.6 may allow an authenticated attack… |
CVE-2023-29184 | Low | 3.2 | 2025-06-10 | An incomplete cleanup vulnerability [CWE-459] in FortiOS 7.2 all versions and before & FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 allows a VDOM p… |
CVE-2023-20599 | High | 7.9 | 2025-06-10 | Improper register access control in ASP may allow a privileged attacker to perform unauthorized access to ASP’s Crypto Co-Processor (CCP) registers from x86 re… |
CVE-2023-26005 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Fitrush allows PHP Local File… |
CVE-2023-25999 | High | 8.1 | 2025-06-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme BodyCenter - Gym, Fitness Woo… |
CVE-2023-26003 | High | 7.6 | 2025-06-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vipul Jariwala WP Post Corrector allows SQL Injection. Th… |
CVE-2023-26002 | Medium | 4.3 | 2025-06-06 | Missing Authorization vulnerability in 6Storage 6Storage Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects 6S… |
CVE-2023-26001 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marchetti Design Next Event Calendar allows Stored XSS. T… |
CVE-2023-26000 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hanhdo205 Bang tinh vay allows Stored XSS. This issue aff… |
CVE-2023-25997 | Medium | 6.5 | 2025-06-06 | Missing Authorization vulnerability in SolaPlugins Sola Support Ticket allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affe… |
CVE-2023-25995 | High | 7.5 | 2025-06-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in choicehomemortgage AI Mortgage Calcula… |
CVE-2023-2921 | High | 8.8 | 2025-06-06 | The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to a SQL injection exp… |
CVE-2023-26226 | Critical | 9.8 | 2025-05-30 | A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682 |
CVE-2023-41591 | Critical | 9.8 | 2025-05-29 | An issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC addresses and potentially execute a man-in-the-middle attack on communic… |
CVE-2023-34873 | | 2025-05-23 | On MOBOTIX P3 cameras before MX-V4.7.2.18 and Mx6 cameras before MX-V5.2.0.61, the tcpdump feature does not properly validate input, which allows authenticated… | |
CVE-2023-53154 | Low | 2.9 | 2025-05-23 | parse_string in cJSON before 1.7.18 has a heap-based buffer over-read via {"1":1, with no trailing newline if cJSON_ParseWithLength is called. |
CVE-2023-47466 | Low | 2.9 | 2025-05-22 | TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk. |
CVE-2023-33861 | Medium | 6.5 | 2025-05-20 | IBM Security ReaQta EDR 3.12 could allow an attacker to spoof a trusted entity by interfering with the communication path between the host and client. |
CVE-2023-7297 | Low | 3.5 | 2025-05-15 | The TwitterPosts WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in a… |
CVE-2023-7239 | High | 7.5 | 2025-05-15 | The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX action… |
CVE-2023-7231 | High | 7.3 | 2025-05-15 | The illi Link Party! WordPress plugin through 1.0 lacks proper access controls, allowing unauthenticated visitors to delete links. |
CVE-2023-7230 | Medium | 6.1 | 2025-05-15 | The illi Link Party! WordPress plugin through 1.0 does not sanitize and escape some parameters, which could allow users with a role as low as admin to perform… |
CVE-2023-7229 | Medium | 5.5 | 2025-05-15 | The illi Link Party! WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2023-7228 | Medium | 6.1 | 2025-05-15 | The illi Link Party! WordPress plugin through 1.0 does not sanitise and escape some parameters, which could allow unauthenticated vistors to perform Cross-Site… |
CVE-2023-7197 | High | 7.1 | 2025-05-15 | The Marketing Twitter Bot WordPress plugin through 1.11 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could a… |
CVE-2023-7196 | Medium | 4.3 | 2025-05-15 | The Ultimate Noindex Nofollow Tool WordPress plugin through 1.1.2 does not have CSRF check in place when updating its settings, which could allow attackers to… |
CVE-2023-7195 | Medium | 4.3 | 2025-05-15 | The WP-Reply Notify WordPress plugin through 1.1 does not have a CSRF check in place when updating its settings, which could allow attackers to make a logged-i… |
CVE-2023-7174 | High | 7.1 | 2025-05-15 | The aBitGone CommentSafe WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could a… |
CVE-2023-7168 | Medium | 4.8 | 2025-05-15 | The Better Follow Button for Jetpack WordPress plugin through 8.0 does not sanitise and escape some of its settings, which could allow high privilege users suc… |
CVE-2023-7088 | Medium | 5.4 | 2025-05-15 | The Add SVG Support for Media Uploader | inventivo WordPress plugin through 1.0.5 does not sanitize uploaded SVG files, which could allow users with a role as… |
CVE-2023-7086 | Medium | 5.4 | 2025-05-15 | The SVG Uploads Support WordPress plugin through 2.1.1 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a m… |
CVE-2023-6786 | Medium | 6.1 | 2025-05-15 | The Payment Gateway for Telcell WordPress plugin through 2.0.1 does not validate the api_url parameter before redirecting the user to its value, leading to an… |
CVE-2023-6783 | Medium | 4.8 | 2025-05-15 | The WolfNet IDX for WordPress plugin through 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2023-6541 | Medium | 6.1 | 2025-05-15 | The Allow SVG WordPress plugin before 1.2.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SV… |
CVE-2023-6030 | Medium | 5.4 | 2025-05-15 | The LogDash Activity Log WordPress plugin before 1.1.4 hooks the wp_login_failed function (from src/Hooks/Users.php) in order to log failed login attempts to t… |
CVE-2023-5934 | High | 7.3 | 2025-05-15 | The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings from the v1, which c… |
CVE-2023-5932 | Medium | 4.8 | 2025-05-15 | The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.14 does not sanitise and escape a parameter before outputting it back in the page… |
CVE-2023-5529 | Medium | 4.8 | 2025-05-15 | The Advanced Page Visit Counter WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such a… |
CVE-2023-2334 | Medium | 5.4 | 2025-05-15 | The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF… |
CVE-2023-53146 | Medium | 5.5 | 2025-05-14 | In the Linux kernel, the following vulnerability has been resolved: media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() In dw2102_i2c_transfer, msg is… |
CVE-2023-31359 | High | 7.3 | 2025-05-13 | Incorrect default permissions in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code exe… |
CVE-2023-31358 | High | 7.3 | 2025-05-13 | A DLL hijacking vulnerability in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code exe… |
CVE-2023-49641 | Critical | 9.8 | 2025-05-13 | Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the loginCheck.php resource does not… |
CVE-2023-34732 | Medium | 5.4 | 2025-05-12 | An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c allows attackers to execute brute force… |
CVE-2023-53145 | High | 7.8 | 2025-05-10 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition In btsdi… |
CVE-2023-31585 | Critical | 9.8 | 2025-05-08 | Grocery-CMS-PHP-Restful-API v1.3 is vulnerable to File Upload via /admin/add-category.php. |
CVE-2023-51328 | Medium | 5.4 | 2025-05-08 | PHPJabbers Cleaning Business Software v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "c_name, name" parameters. |
CVE-2023-51295 | Medium | 6.5 | 2025-05-08 | PHPJabbers Event Booking Calendar v4.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_ap… |
CVE-2023-7303 | Low | 3.5 | 2025-05-07 | A vulnerability, which was classified as problematic, was found in q2apro q2apro-on-site-notifications up to 1.4.6. This affects the function process_request o… |
CVE-2023-33770 | Medium | 5.1 | 2025-05-06 | Real Estate Management System v1.0 was discovered to contain a SQL injection vulnerability via the message parameter at /contact.php. |
CVE-2023-53144 | Medium | 5.5 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms As the call trace shown, the… |
CVE-2023-53143 | Medium | 5.5 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix another off-by-one fsmap error on 1k block filesystems Apparently syzbot figure… |
CVE-2023-53142 | High | 7.8 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: ice: copy last block omitted in ice_get_module_eeprom() ice_get_module_eeprom() is broken… |
CVE-2023-53141 | Medium | 5.5 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() ila_xlat_nl_cmd_get_… |
CVE-2023-53140 | Medium | 5.5 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: scsi: core: Remove the /proc/scsi/${proc_name} directory earlier Remove the /proc/scsi/${… |
CVE-2023-53139 | Medium | 5.5 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties devm… |
CVE-2023-53138 | High | 7.8 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: net: caif: Fix use-after-free in cfusbl_device_notify() syzbot reported use-after-free in… |
CVE-2023-53136 | High | 7.1 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: af_unix: fix struct pid leaks in OOB support syzbot reported struct pid leak [1]. Issue… |
CVE-2023-53135 | High | 7.1 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode When CONFIG_FRAME_POINTER… |
CVE-2023-53134 | Medium | 5.5 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Avoid order-5 memory allocation for TPA data The driver needs to keep track of a… |
CVE-2023-53133 | Medium | 5.5 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() When t… |
CVE-2023-53132 | Medium | 5.5 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove() Free mpi3mr_hba_port at… |
CVE-2023-53131 | Medium | 5.5 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a server shutdown leak Fix a race where kthread_stop() may prevent the thread… |
CVE-2023-53128 | Medium | 5.5 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix throttle_groups memory leak Add a missing kfree(). |
CVE-2023-53127 | Medium | 5.5 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix expander node leak in mpi3mr_remove() Add a missing resource clean up i… |
CVE-2023-53126 | Medium | 5.5 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove() Free mrioc->sas_hba.phy at… |
CVE-2023-53125 | Medium | 5.5 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Limit packet length to skb->len Packet length retrieved from skb data… |
CVE-2023-53124 | Medium | 5.5 | 2025-05-02 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Port is allocated… |