2023 CVEs (page 150)
Page 150 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-43663 | Medium | 6.3 | 2023-09-28 | PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user ri… |
CVE-2023-43657 | High | 7.2 | 2023-09-28 | discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross… |
CVE-2023-43044 | Medium | 5.3 | 2023-09-28 | IBM License Metric Tool 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request contain… |
CVE-2023-40375 | High | 7.4 | 2023-09-28 | Integrated application server for IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability. A malicious actor with command line access… |
CVE-2023-5217 | High | 8.8 | 2023-09-28 | Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap… |
CVE-2023-5187 | High | 8.8 | 2023-09-28 | Use after free in Extensions in Google Chrome prior to 117.0.5938.132 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2023-5186 | High | 8.8 | 2023-09-28 | Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UI interaction to pot… |
CVE-2023-30415 | Critical | 9.8 | 2023-09-28 | Sourcecodester Packers and Movers Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /inquiries/view_inquir… |
CVE-2023-43884 | Medium | 5.4 | 2023-09-28 | A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or… |
CVE-2023-43879 | Medium | 4.8 | 2023-09-28 | Rite CMS 3.0 has a Cross-Site scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload into the Global Content Block… |
CVE-2023-43878 | Medium | 5.4 | 2023-09-28 | Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a crafted payload into the Main Menu It… |
CVE-2023-43876 | Medium | 5.4 | 2023-09-28 | A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload inject… |
CVE-2023-5215 | Medium | 5.3 | 2023-09-28 | A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could l… |
CVE-2023-43874 | Medium | 5.4 | 2023-09-28 | Multiple Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Copyright a… |
CVE-2023-43873 | Medium | 5.4 | 2023-09-28 | A Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Name filed in the… |
CVE-2023-43872 | Medium | 5.4 | 2023-09-28 | A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS). |
CVE-2023-43871 | Medium | 5.4 | 2023-09-28 | A File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS). |
CVE-2023-43868 | High | 7.5 | 2023-09-28 | D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via websGetVar function. |
CVE-2023-43867 | High | 7.5 | 2023-09-28 | D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanL2TP function. |
CVE-2023-43866 | High | 7.5 | 2023-09-28 | D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard7 function. |
CVE-2023-43865 | High | 7.5 | 2023-09-28 | D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanPPTP function. |
CVE-2023-43864 | High | 7.5 | 2023-09-28 | D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard55 function. |
CVE-2023-43863 | High | 7.5 | 2023-09-28 | D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanDhcpplus function. |
CVE-2023-43862 | High | 7.5 | 2023-09-28 | D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formLanguageChange function. |
CVE-2023-43861 | High | 7.5 | 2023-09-28 | D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanPPPoE function. |
CVE-2023-43860 | High | 7.5 | 2023-09-28 | D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanNonLogin function. |
CVE-2023-42756 | Medium | 4.4 | 2023-09-28 | A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to th… |
CVE-2023-40307 | Medium | 6.3 | 2023-09-28 | An attacker with standard privileges on macOS when requesting administrator privileges from the application can submit input which causes a buffer overflow res… |
CVE-2023-43869 | Critical | 9.8 | 2023-09-28 | D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard56 function. |
CVE-2023-5233 | Medium | 6.4 | 2023-09-28 | The Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fawesome' shortcode in versions up to, and including, 5.0 d… |
CVE-2023-5232 | Medium | 6.4 | 2023-09-28 | The Font Awesome More Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' shortcode in versions up to, and including, 3.5 due to… |
CVE-2023-5230 | Medium | 6.4 | 2023-09-28 | The TM WooCommerce Compare & Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tm_woo_wishlist_table' shortcode in versions up to… |
CVE-2023-44276 | Medium | 5.4 | 2023-09-28 | OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard. |
CVE-2023-44275 | Medium | 5.4 | 2023-09-28 | OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard. |
CVE-2023-26149 | Medium | 6.1 | 2023-09-28 | Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, via the renderList fun… |
CVE-2023-26145 | High | 7.4 | 2023-09-28 | This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept… |
CVE-2023-44273 | Critical | 9.8 | 2023-09-28 | Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the… |
CVE-2023-38877 | High | 8.8 | 2023-09-28 | A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). By sending a specially crafted host header in… |
CVE-2023-38874 | High | 8.8 | 2023-09-28 | A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious… |
CVE-2023-38873 | Medium | 6.5 | 2023-09-28 | The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a "UI redress attack", is when… |
CVE-2023-38872 | Low | 3.7 | 2023-09-28 | An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthenticated attacker… |
CVE-2023-38871 | Medium | 5.3 | 2023-09-28 | The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. Th… |
CVE-2023-38870 | Critical | 9.8 | 2023-09-28 | A SQL injection vulnerability exists in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1. The cash book has a feature to list accomplishments by… |
CVE-2023-42222 | High | 8.8 | 2023-09-28 | WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is f… |
CVE-2023-41450 | High | 8.8 | 2023-09-28 | An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the reque parameter. |
CVE-2023-41447 | Medium | 6.1 | 2023-09-28 | Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the subcmd para… |
CVE-2023-41446 | Medium | 6.1 | 2023-09-28 | Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted script to the title parame… |
CVE-2023-41444 | High | 7.8 | 2023-09-28 | An issue in Binalyze IREC.sys v.3.11.0 and before allows a local attacker to execute arbitrary code and escalate privileges via the fun_1400084d0 function in I… |
CVE-2023-5244 | Medium | 6.1 | 2023-09-28 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-43320 | High | 8.8 | 2023-09-27 | An issue in Proxmox Server Solutions GmbH Proxmox VE v.5.4 thru v.8.0, Proxmox Backup Server v.1.1 thru v.3.0, and Proxmox Mail Gateway v.7.1 thru v.8.0 allows… |
CVE-2023-43314 | High | 7.5 | 2023-09-27 | ** UNSUPPORTED WHEN ASSIGNED **The buffer overflow vulnerability in the Zyxel PMG2005-T20B firmware version V1.00(ABNK.2)b11_C0 could allow an unauthenticated… |
CVE-2023-43233 | Medium | 6.1 | 2023-09-27 | A stored cross-site scripting (XSS) vulnerability in the cms/content/edit component of YZNCMS v1.3.0 allows attackers to execute arbitrary web scripts or HTML… |
CVE-2023-43191 | Medium | 5.4 | 2023-09-27 | SpringbootCMS 1.0 foreground message can be embedded malicious code saved in the database. When users browse the comments, these malicious codes embedded in th… |
CVE-2023-41453 | Medium | 6.1 | 2023-09-27 | Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the cmd paramet… |
CVE-2023-41452 | High | 8.8 | 2023-09-27 | Cross Site Request Forgery vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the txt p… |
CVE-2023-41451 | Medium | 6.1 | 2023-09-27 | Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the txt paramet… |
CVE-2023-41449 | Critical | 9.8 | 2023-09-27 | An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the reque parameter. |
CVE-2023-41448 | Medium | 6.1 | 2023-09-27 | Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the ID paramete… |
CVE-2023-41445 | Medium | 6.1 | 2023-09-27 | Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the index.php c… |
CVE-2023-44080 | Critical | 9.8 | 2023-09-27 | An issue in PGYER codefever v.2023.8.14-2ce4006 allows a remote attacker to execute arbitrary code via a crafted request to the branchList component. |
CVE-2023-43660 | Medium | 4.8 | 2023-09-27 | Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by s… |
CVE-2023-43192 | High | 8.8 | 2023-09-27 | SQL injection can exist in a newly created part of the SpringbootCMS 1.0 background, and the parameters submitted by users are not filtered. As a result, speci… |
CVE-2023-4066 | Medium | 5.5 | 2023-09-27 | A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; ho… |
CVE-2023-43656 | Medium | 5.6 | 2023-09-27 | matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions (… |
CVE-2023-43651 | High | 8.5 | 2023-09-27 | JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remo… |
CVE-2023-42818 | Medium | 5.4 | 2023-09-27 | JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding… |
CVE-2023-40026 | Medium | 5.0 | 2023-09-27 | Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 (starting at least in v0.1.0, but likely in any versi… |
CVE-2023-44048 | Medium | 5.4 | 2023-09-27 | Sourcecodester Expense Tracker App v1 is vulnerable to Cross Site Scripting (XSS) via add category. |
CVE-2023-44047 | High | 7.2 | 2023-09-27 | Sourcecodester Toll Tax Management System v1 is vulnerable to SQL Injection. |
CVE-2023-4523 | Critical | 9.4 | 2023-09-27 | Real Time Automation 460 Series products with versions prior to v8.9.8 are vulnerable to cross-site scripting, which could allow an attacker to run any JavaSc… |
CVE-2023-43652 | High | 8.2 | 2023-09-27 | JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key wit… |
CVE-2023-43650 | High | 8.2 | 2023-09-27 | JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate… |
CVE-2023-33972 | High | 7.2 | 2023-09-27 | Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keys… |
CVE-2023-5184 | High | 7.0 | 2023-09-27 | Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers. |
CVE-2023-42822 | Medium | 4.6 | 2023-09-27 | xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controlla… |
CVE-2023-20268 | Medium | 4.7 | 2023-09-27 | A vulnerability in the packet processing functionality of Cisco access point (AP) software could allow an unauthenticated, adjacent attacker to exhaust resourc… |
CVE-2023-20262 | Medium | 5.3 | 2023-09-27 | A vulnerability in the SSH service of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to cause a process crash, resulting in a Do… |
CVE-2023-20254 | High | 7.2 | 2023-09-27 | A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow an authenticated, remote attacker to acc… |
CVE-2023-20253 | High | 7.1 | 2023-09-27 | A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authenticated, local attacker to bypass authori… |
CVE-2023-20252 | Critical | 9.8 | 2023-09-27 | A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker… |
CVE-2023-20251 | Medium | 6.1 | 2023-09-27 | A vulnerability in the memory buffer of Cisco Wireless LAN Controller (WLC) AireOS Software could allow an unauthenticated, adjacent attacker to cause memory l… |
CVE-2023-20231 | High | 8.8 | 2023-09-27 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device… |
CVE-2023-20227 | High | 8.6 | 2023-09-27 | A vulnerability in the Layer 2 Tunneling Protocol (L2TP) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of… |
CVE-2023-20226 | High | 8.6 | 2023-09-27 | A vulnerability in Application Quality of Experience (AppQoE) and Unified Threat Defense (UTD) on Cisco IOS XE Software could allow an unauthenticated, remote… |
CVE-2023-20223 | High | 8.6 | 2023-09-27 | A vulnerability in Cisco DNA Center could allow an unauthenticated, remote attacker to read and modify data in a repository that belongs to an internal service… |
CVE-2023-20202 | Medium | 6.1 | 2023-09-27 | A vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers could allow an unauthenticated, adjacent at… |
CVE-2023-20187 | High | 8.6 | 2023-09-27 | A vulnerability in the Multicast Leaf Recycle Elimination (mLRE) feature of Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers could… |
CVE-2023-20186 | High | 8.0 | 2023-09-27 | A vulnerability in the Authentication, Authorization, and Accounting (AAA) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated… |
CVE-2023-20179 | Medium | 4.3 | 2023-09-27 | A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote att… |
CVE-2023-20176 | Medium | 5.8 | 2023-09-27 | A vulnerability in the networking component of Cisco access point (AP) software could allow an unauthenticated, remote attacker to cause a temporary disruption… |
CVE-2023-20109 | Medium | 6.6 | 2023-09-27 | A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remo… |
CVE-2023-20034 | High | 7.5 | 2023-09-27 | Vulnerability in the Elasticsearch database used in the of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to access the Elastics… |
CVE-2023-20033 | High | 8.6 | 2023-09-27 | A vulnerability in Cisco IOS XE Software for Cisco Catalyst 3650 and Catalyst 3850 Series Switches could allow an unauthenticated, remote attacker to cause an… |
CVE-2023-4129 | Medium | 5.9 | 2023-09-27 | Dell Data Protection Central, version 19.9, contains an Inadequate Encryption Strength Vulnerability. An unauthenticated network attacker could potentially ex… |
CVE-2023-43125 | Medium | 6.8 | 2023-09-27 | BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated |
CVE-2023-43124 | Medium | 5.3 | 2023-09-27 | BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated |
CVE-2023-32458 | High | 7.3 | 2023-09-27 | Dell AppSync, versions 4.4.0.0 to 4.6.0.0 including Service Pack releases, contains an improper access control vulnerability in Embedded Service Enabler compo… |
CVE-2023-5223 | Medium | 6.3 | 2023-09-27 | A vulnerability, which was classified as critical, has been found in HimitZH HOJ up to 4.6-9a65e3f. This issue affects some unknown processing of the component… |
CVE-2023-5222 | Medium | 6.3 | 2023-09-27 | A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. This vulnerability affects the function isValidUser of the file /cgi-… |
CVE-2023-5221 | Medium | 4.7 | 2023-09-27 | A vulnerability classified as critical has been found in ForU CMS. This affects an unknown part of the file /install/index.php. The manipulation of the argumen… |