2023 CVEs (page 152)
Page 152 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40669 | Medium | 6.5 | 2023-09-27 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in twinpictures, baden03 Collapse-O-Matic plugin <= 1.8.5.5 versions. |
CVE-2023-40668 | Medium | 5.9 | 2023-09-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd plugin <= 2.16.0 versions. |
CVE-2023-40667 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Lasso Simple URLs plugin <= 117 versions. |
CVE-2023-40665 | Medium | 5.9 | 2023-09-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pdfcrowd Save as Image plugin by Pdfcrowd plugin <= 2.16.0 versions. |
CVE-2023-40664 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao Donations Made Easy – Smart Donations plugin <= 4.0.12 versions. |
CVE-2023-40663 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rextheme WP VR plugin <= 8.3.4 versions. |
CVE-2023-40605 | Medium | 6.5 | 2023-09-27 | Auth. (contributor) Cross-Site Scripting (XSS) vulnerability in 93digital Typing Effect plugin <= 1.3.6 versions. |
CVE-2023-40604 | Medium | 5.9 | 2023-09-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jes Madsen Cookies by JM plugin <= 1.0 versions. |
CVE-2023-40541 | Medium | 5.5 | 2023-09-27 | This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14. A shortcut may output sensitive user data wit… |
CVE-2023-40532 | Medium | 4.3 | 2023-09-27 | Path traversal vulnerability in Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain partial information of the fi… |
CVE-2023-40520 | Low | 3.3 | 2023-09-27 | The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10. An app may be able to access edited photos save… |
CVE-2023-40456 | Low | 3.3 | 2023-09-27 | The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10. An app may be able to access edited photos save… |
CVE-2023-40455 | Critical | 10.0 | 2023-09-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed process may be able to circumvent sandbox r… |
CVE-2023-40454 | High | 7.1 | 2023-09-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12… |
CVE-2023-40452 | High | 7.1 | 2023-09-27 | The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17… |
CVE-2023-40451 | High | 8.8 | 2023-09-27 | This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 17. An attacker with JavaScript execution may be able to execu… |
CVE-2023-40450 | Medium | 5.5 | 2023-09-27 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may bypass Gatekeeper checks. |
CVE-2023-40448 | High | 8.6 | 2023-09-27 | The issue was addressed with improved handling of protocols. This issue is fixed in tvOS 17, iOS 16.7 and iPadOS 16.7, watchOS 10, iOS 17 and iPadOS 17, macOS… |
CVE-2023-40443 | High | 7.8 | 2023-09-27 | The issue was addressed with improved checks. This issue is fixed in iOS 17 and iPadOS 17. An app may be able to gain root privileges. |
CVE-2023-40441 | Medium | 6.5 | 2023-09-27 | A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content… |
CVE-2023-40436 | Critical | 9.1 | 2023-09-27 | The issue was addressed with improved bounds checks. This issue is fixed in macOS Sonoma 14. An attacker may be able to cause unexpected system termination or… |
CVE-2023-40435 | Medium | 5.5 | 2023-09-27 | This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 15. An app may be able to access App Store credentials. |
CVE-2023-40434 | Low | 3.3 | 2023-09-27 | A configuration issue was addressed with additional restrictions. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to access a… |
CVE-2023-40432 | High | 7.8 | 2023-09-27 | The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may be able to… |
CVE-2023-40431 | High | 7.8 | 2023-09-27 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17 and iPadOS 17. An app may be able to execute arbitrary code with kernel pr… |
CVE-2023-40429 | Medium | 5.5 | 2023-09-27 | A permissions issue was addressed with improved validation. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may be ab… |
CVE-2023-40428 | Medium | 5.5 | 2023-09-27 | The issue was addressed with improved handling of caches. This issue is fixed in iOS 17 and iPadOS 17. An app may be able to access sensitive user data. |
CVE-2023-40427 | Low | 3.3 | 2023-09-27 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadO… |
CVE-2023-40426 | Medium | 5.5 | 2023-09-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. An app may be able to bypass certain Privacy preference… |
CVE-2023-40424 | Medium | 5.5 | 2023-09-27 | The issue was addressed with improved checks. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may be able to access user-sensi… |
CVE-2023-40422 | Medium | 5.5 | 2023-09-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14. An app may be able to cause a denial-of-service. |
CVE-2023-40420 | Medium | 6.5 | 2023-09-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watch… |
CVE-2023-40419 | High | 7.8 | 2023-09-27 | The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10. An app may be able to gain elevated privileges. |
CVE-2023-40418 | Medium | 5.5 | 2023-09-27 | An authentication issue was addressed with improved state management. This issue is fixed in watchOS 10. An Apple Watch Ultra may not lock when using the Depth… |
CVE-2023-40417 | Medium | 5.4 | 2023-09-27 | A window management issue was addressed with improved state management. This issue is fixed in Safari 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. Vi… |
CVE-2023-40412 | High | 7.8 | 2023-09-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 1… |
CVE-2023-40410 | Medium | 5.5 | 2023-09-27 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOS 17… |
CVE-2023-40409 | High | 7.8 | 2023-09-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 1… |
CVE-2023-40407 | High | 7.5 | 2023-09-27 | The issue was addressed with improved bounds checks. This issue is fixed in macOS Sonoma 14. A remote attacker may be able to cause a denial-of-service. |
CVE-2023-40406 | Medium | 5.5 | 2023-09-27 | The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, macOS Ventura 13.6, macOS Sonoma 14. An app may be able to read arbit… |
CVE-2023-40403 | Medium | 6.5 | 2023-09-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watch… |
CVE-2023-40402 | Medium | 5.5 | 2023-09-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. An app may be able to access sensitive user data. |
CVE-2023-40400 | Critical | 9.8 | 2023-09-27 | This issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. A remote user may cause an un… |
CVE-2023-40399 | Medium | 5.5 | 2023-09-27 | The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may be able to… |
CVE-2023-40395 | Low | 3.3 | 2023-09-27 | The issue was addressed with improved handling of caches. This issue is fixed in tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and… |
CVE-2023-40391 | Medium | 5.5 | 2023-09-27 | The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, macOS Sonoma 14, Xcode 15. An app may be able to d… |
CVE-2023-40388 | Medium | 4.3 | 2023-09-27 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14. Safari may save photos to an unprotected locat… |
CVE-2023-40386 | Low | 3.3 | 2023-09-27 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14. An app may be able to access Notes attachments. |
CVE-2023-40384 | Low | 3.3 | 2023-09-27 | A permissions issue was addressed with improved redaction of sensitive information. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, macOS Sonoma 14. An a… |
CVE-2023-40333 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Qode Interactive Bridge Core plugin <= 3.0.9 versions. |
CVE-2023-40330 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Milan Petrovic GD Security Headers plugin <= 1.6.1 versions. |
CVE-2023-40219 | High | 7.2 | 2023-09-27 | Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload an arbitrary file to an unauthorized directory. |
CVE-2023-40049 | Medium | 5.3 | 2023-09-27 | In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServiceHost' directory listing. |
CVE-2023-40048 | Medium | 6.8 | 2023-09-27 | In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on a POST transactio… |
CVE-2023-40047 | High | 8.3 | 2023-09-27 | In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module. An attacker with ad… |
CVE-2023-40046 | High | 8.2 | 2023-09-27 | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able t… |
CVE-2023-40045 | High | 8.3 | 2023-09-27 | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module… |
CVE-2023-40044 | Critical | 10.0 | 2023-09-27 | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer mod… |
CVE-2023-3767 | Critical | 9.8 | 2023-09-27 | An OS command injection vulnerability has been found on EasyPHP Webserver affecting version 14.1. This vulnerability could allow an attacker to get full acces… |
CVE-2023-3223 | High | 7.5 | 2023-09-27 | A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorize… |
CVE-2023-39434 | High | 8.8 | 2023-09-27 | A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. Processing web… |
CVE-2023-39378 | High | 8.8 | 2023-09-27 | SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') by an unauthenticated user |
CVE-2023-39377 | High | 7.2 | 2023-09-27 | SiberianCMS - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous fil… |
CVE-2023-39376 | Medium | 6.5 | 2023-09-27 | SiberianCMS - CWE-284 Improper Access Control Authorized user may disable a security feature over the network |
CVE-2023-39375 | High | 7.5 | 2023-09-27 | SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges |
CVE-2023-39347 | High | 7.6 | 2023-09-27 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labels can cause Cilium t… |
CVE-2023-39233 | Medium | 6.5 | 2023-09-27 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may disclose sensitive information. |
CVE-2023-38615 | High | 7.8 | 2023-09-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14. An app may be able to execute arbitrary code with kernel privile… |
CVE-2023-38596 | Medium | 5.5 | 2023-09-27 | The issue was addressed with improved handling of protocols. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may fail… |
CVE-2023-38586 | Critical | 10.0 | 2023-09-27 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed process may be able to circumvent sandb… |
CVE-2023-37448 | Low | 3.3 | 2023-09-27 | A lock screen issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14. A user may be able to view restricted content from th… |
CVE-2023-36851 | Medium | 5.3 | 2023-09-27 | A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to ca… |
CVE-2023-35990 | Low | 3.3 | 2023-09-27 | The issue was addressed with improved checks. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14. An app may be… |
CVE-2023-35984 | Medium | 4.3 | 2023-09-27 | The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An attacker in physical proxim… |
CVE-2023-35793 | High | 8.8 | 2023-09-27 | An issue was discovered in Cassia Access Controller 2.1.1.2303271039. Establishing a web SSH session to gateways is vulnerable to Cross Site Request Forgery (C… |
CVE-2023-35074 | High | 8.8 | 2023-09-27 | The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing… |
CVE-2023-35071 | Critical | 9.8 | 2023-09-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MRV Tech Logging Administration Panel allows SQL Injectio… |
CVE-2023-34043 | Medium | 6.7 | 2023-09-27 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privi… |
CVE-2023-32541 | High | 8.8 | 2023-09-27 | A use-after-free vulnerability exists in the footerr functionality of Hancom Office 2020 HWord 11.0.0.7520. A specially crafted .doc file can lead to a use-aft… |
CVE-2023-32421 | Medium | 5.5 | 2023-09-27 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14. An app may be able to observe unprotected user… |
CVE-2023-32396 | High | 7.8 | 2023-09-27 | This issue was addressed with improved checks. This issue is fixed in Xcode 15, tvOS 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able… |
CVE-2023-32377 | High | 7.8 | 2023-09-27 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14. An app may be able to execute arbitrary code with… |
CVE-2023-32361 | Medium | 5.5 | 2023-09-27 | The issue was addressed with improved handling of caches. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may be able… |
CVE-2023-30961 | Medium | 6.5 | 2023-09-27 | Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly c… |
CVE-2023-30959 | Medium | 4.1 | 2023-09-27 | In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction. |
CVE-2023-30493 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.2.0 versions. |
CVE-2023-30472 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MyThemeShop URL Shortener by MyThemeShop plugin <= 1.0.17 versions. |
CVE-2023-30471 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cornel Raiu WP Search Analytics plugin <= 1.4.7 versions. |
CVE-2023-2358 | Medium | 4.3 | 2023-09-27 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in p… |
CVE-2023-2315 | High | 8.1 | 2023-09-27 | Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary fi… |
CVE-2023-29497 | Low | 3.3 | 2023-09-27 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14. An app may be able to access calendar data sav… |
CVE-2023-28790 | Medium | 5.9 | 2023-09-27 | Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Brett Shumaker Simple Staff List plugin <= 2.2.3 versions. |
CVE-2023-28490 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <= 2.0.7 versions. |
CVE-2023-28055 | High | 8.8 | 2023-09-27 | Dell NetWorker, Version 19.7 has an improper authorization vulnerability in the NetWorker client. An unauthenticated attacker within the same network could po… |
CVE-2023-27628 | Medium | 6.5 | 2023-09-27 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Webvitaly Sitekit plugin <= 1.3 versions. |
CVE-2023-27622 | Medium | 5.9 | 2023-09-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Abel Ruiz GuruWalk Affiliates plugin <= 1.0.0 versions. |
CVE-2023-27617 | Medium | 5.9 | 2023-09-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David F. Carr RSVPMaker plugin <= 10.6.6 versions. |
CVE-2023-27616 | High | 7.1 | 2023-09-27 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in David F. Carr RSVPMaker plugin <= 10.6.6 versions. |
CVE-2023-25483 | Medium | 5.9 | 2023-09-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ankit Agarwal, Priyanshu Mittal Easy Coming Soon plugin <= 2.3 versions. |
CVE-2023-23958 | Medium | 6.8 | 2023-09-27 | Symantec Protection Engine, prior to 9.1.0, may be susceptible to a Hash Leak vulnerability. |